MySQL is an open-source relational database management system.

learn more… | top users | synonyms

1
vote
1answer
144 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
1
vote
1answer
419 views

MySQL AES Encryption - Is it good idea to store 3rd Party Auth Tokens using AES Encryption?

I need some advice on MySQL AES Encryption. I'm developing an application which connects to various 3rd-Party APIs and retrieves the Access Tokens for the application users. These Access Tokens are ...
1
vote
1answer
285 views

Securing Publicly Exposed MySQL Database for Group CS Project

Hello I am looking for some advice. For an Advanced C++ Programming Course I am taking another student and doing a project. For this project we plan on using a MySQL Database as our backend database.I ...
1
vote
4answers
445 views

Check for database tampering

I have a database table that I want to confirm has not been tinkered with. My theory is to create a hash of static items and store that in the table. Then compare these when the data is required, for ...
1
vote
1answer
122 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
1
vote
0answers
43 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
0answers
78 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
244 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
1
vote
0answers
352 views

MySQL Database Activity Monitoring Solutions [closed]

We are looking for a DAM solution for MySQL. There is of course GreenSQL but it seems to lack some of the features we desire like robust filtering of reports for export purposes, etc. It's very ...
0
votes
1answer
57 views

how to get mysql user password? [closed]

I have a problem. I am creating a mysql user, and mysql will store the hashed password in user table. The problem is I dont know how to get the password back. As it is hashed, we can't get it back. ...
0
votes
4answers
482 views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
0
votes
2answers
71 views

Is it necessary to use SSL for MySQL?

I have a MySQL and Apache web server (both are installed on the same machine). Users will interact with it by a VB.NET application and the web. The server is accessible by the Internet. VB.NET ...
0
votes
1answer
196 views

Is SQL Injection possible in this PHP registration script? [closed]

I've recently created a PHP registration script for a website that a friend and I are working on. I've read up on the dangers of MySQL injection, and I was wondering if my current code is protected ...
0
votes
3answers
94 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
0
votes
1answer
58 views

Securing SQL injection for my PHP files [on hold]

I have made a PHP forum. I used PDO, as well as SQLi. When I did a security scan of my website, it found errors, and after a long time of trying different stuff, I can't fix them. Points to whomever ...
0
votes
1answer
227 views

SQL injection on query (MySQL/PHP) [closed]

First, sorry if my issue is a duplicate! This is an exercise that I can not solve. It is an authentication, simply. But the problem is that the application does not check both the password and ...
0
votes
2answers
76 views

Possible security issues with on demand generated image from database

I want to know what could be the potential risk with the displaying part of this behavior. For the upload part : 1- A form with a file upload for image. 2- Image content is save into Mysql ...
0
votes
2answers
2k views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
0
votes
2answers
149 views

Security on Ubuntu 12.04 LST Server for Business App

I am developing bussines application based on php and mysql on ubuntu 12.04 lts server. I have closed all ports except :80 and php code can be executed only by security login and not using cookies but ...
0
votes
2answers
158 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
0
votes
3answers
692 views

Is there such a thing as MySQL connection flooding?

I'm a developer for a small website. There are 3 webservers (for load balancing) and a MySQL server. Today the webservers seem to be down, and, unfortunately, I cannot get hold of the admin (he's in ...
0
votes
1answer
60 views

MySQL Database Password protection

I am developing an industry-level web server that requires that all passwords be encrypted in some way. The middle-ware for the server is Java-based. My only restriction is that I can't use API's ...
0
votes
1answer
870 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
1answer
1k views

Protecting MYSQL with Fail2Ban? [closed]

I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously ...
0
votes
1answer
387 views

What are the reasons this SQL injection code wouldn't work? [duplicate]

In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database. We ...
0
votes
1answer
494 views

Is it secure to use a custom written Php extension for handling + hashing (db) keys?

I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it ...
0
votes
1answer
202 views

Facebook data visibility to admin staff

I recently had a conversation with a friend in which I told him that everything written on Facebook can be seen by the Facebook admin staff. As a software engineer and database administrator I know ...
0
votes
1answer
44 views

System backup in case of attack?

My system will be running for a well known insurance company within the UK, it will hold and process a lot of information for claims, brakdowns etc etc. I am worried that the company and the site as ...
0
votes
1answer
57 views

Injecting a query within a query that has an order by or group by function [closed]

Select * from Shop where Item = $item order by ProductNum desc I found this vulnerability within a website. To test if there's any vulnerabilities I inserted a single quotation after ...
0
votes
1answer
1k views

sqlmap - Dump multiple columns at once? [closed]

I'm playing around with sqlmap, and I'm having a little trouble dumping database columns. I can dump all of them at once which is great, but this database has thousands of users and dumping every ...
0
votes
1answer
1k views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
0
votes
1answer
211 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]

As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL server, what services and ...
0
votes
1answer
248 views

A Question about Database Encryption [closed]

I've been looking around for an answer to this for some time now and I felt that this place would be a good venue to ask this. How can one improve the security in a MySQL database? The database that ...
0
votes
3answers
2k views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
0
votes
3answers
892 views

Connect to Mysql database from remote host without remote access [closed]

I have a website which is managed through CPanel. I know that remote database connections are disabled by default and I have tested that it is indeed disabled. I know that many people have some of my ...
0
votes
0answers
12 views

How secure is a ODBC connection from MySQL(5.6) to MS Access

I have created a connection from a MySQL server (unpopulated) to Access using their ODBC driver but don't know anything about how secure this connection may or may not be. I do not have openSSL set up ...
0
votes
0answers
36 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query ...
0
votes
0answers
114 views

Improve the security of a website implementing the least privilege principle

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
0
votes
0answers
417 views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
0answers
169 views

HIPAA requirements for local server

I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement. Most computers will most likely have no ...
0
votes
0answers
869 views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: ...
0
votes
1answer
154 views

Sql Injection - Possible exploitations on a real case [duplicate]

This is a snippet of a PHP script: $useragent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL; $query = "SELECT `id` FROM `browser` WHERE name = '".$useragent."' LIMIT ...
0
votes
2answers
289 views

How to perform SQL injection with real_escape_string filter in place?

can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example. function sanitizeStrXSS51($var) { global ...
-1
votes
2answers
65 views

Server Files Got Exposed, What Security Steps Should I Take? [duplicate]

so I made a script that would accept a GET request through a script on my page download the url in the GET and then echo the response. Sort of like an in browser proxy. Basically someone found out ...
-1
votes
1answer
3k views

How to hack linux from phpMyAdmin? [closed]

I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit. i encoded the ...
-1
votes
1answer
166 views

Where can I find good word list for MySQL 5? [closed]

I wonder where can I find good collections of dictionaries which can be used for MySQL 5 dictionary attack? I just need MySQL 5 word lists / dictionaries. I found a lot of MD5, SHA1, etc. but not ...
-1
votes
2answers
3k views

Issues setting up DVWA for SQLMAP [closed]

I am starting on sqlmap, and have dvwa for practicing web app penetration. I am having the error "Could not connect to the database - please check the config file." Not sure what the problem is but ...
-1
votes
1answer
74 views

SQL and Command injection Handling [closed]

My PHP code is: $password = md5(md5($pass); if (is_array($data_array)) { $key = array_keys($data_array); for ($i = 0; $i < count($key); $i++) ...
-1
votes
1answer
73 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
-2
votes
2answers
169 views

How to know table name, and column names for login panel

I want to know the table name and column names of that table in website login page. How should I do that. There are only two input fields, Username and Password. And it is vulnerable to Sql ...