MySQL is an open-source relational database management system.

learn more… | top users | synonyms

0
votes
1answer
47 views

Detecting datasets that were affected by sql injection

Assuming that I know that one of my applications was attacked by an sql injection, how can I identify edited or selected data sets? On obvious source are webserver logs. This should allow us to ...
0
votes
1answer
64 views

Access MySQL via MySQL credentials, assuming no remote MySQL, FTP, or SSH access?

LAMP stack, dedicated server. I set up some MySQL users, gave them full access rights to the necessary databases, and provided the user credentials to some freelance developers. Now that the project ...
0
votes
1answer
113 views

How does one securely create a MySQL database and user via the command line?

I'm making an app whose functionality includes creating a database and its user. This is accomplished like so: mysql -e "grant all on database.* to 'user'@'localhost' identified by '$PW';" $PW is ...
-1
votes
1answer
100 views

why database show vulnerable column when i give a wrong parameter in query?

When we try for inject a website for find vulnerable column then sometimes we need to give a wrong value in the website parameter. Like www.vhul-web.com/index.php?id=1 union select 1,2,3 -- - Now ...
-1
votes
1answer
75 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
4
votes
0answers
34 views

Why would I use at-rest encryption over a DB's key-based encryption?

Goal I want to store encrypted data in a database. Constraints Application-level encryption (encrypting before sending to the DB) is not a reasonable option for my use case. The DB providers I'm ...
2
votes
0answers
119 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
2
votes
0answers
130 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
1
vote
0answers
74 views

Double Query injection

I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation: (select * from (select count(*), concat(0x3a,0x3a,(select ...
1
vote
0answers
49 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
0answers
104 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
383 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
0
votes
0answers
67 views

What does this injected query achieve?

On this very good link you can see some SQL injection expressions for MySQL. Quick Detection Error Based SQLi For integer inputs: (select 1 and row(1,1)>(select ...
0
votes
0answers
49 views

MySQL SQL Injection - Get User Password

I've used SQLMAP to check for SQL injection. I've managed to retrieve the name of just one database (dbInfo) However, using SQLMAP I can't enumerate anything else - where it is tables within the DB ...
0
votes
0answers
53 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
0
votes
0answers
83 views

How secure is a ODBC connection from MySQL(5.6) to MS Access

I have created a connection from a MySQL server (unpopulated) to Access using their ODBC driver but don't know anything about how secure this connection may or may not be. I do not have openSSL set up ...
0
votes
0answers
77 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query ...
0
votes
0answers
1k views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
0answers
248 views

HIPAA requirements for local server

I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement. Most computers will most likely have no ...
0
votes
0answers
2k views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: ...
-1
votes
0answers
28 views

Exploiting User Input in Excel File

I'm doing the most basic of basic development projects having taken over someone else. There is an export that happens from a MySQL DB to a XSLX file. If I put my name in as =A1&A2&A3 then ...