SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

learn more… | top users | synonyms

-4
votes
1answer
66 views

Safest SQL database [on hold]

I am going to run a Tor Hidden Service on a Linux server. My site will have an SQL database. This DB contains user login, and a few other basic details. If it makes a difference depending on the ...
0
votes
1answer
48 views

Detecting datasets that were affected by sql injection

Assuming that I know that one of my applications was attacked by an sql injection, how can I identify edited or selected data sets? On obvious source are webserver logs. This should allow us to ...
5
votes
2answers
150 views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
-3
votes
3answers
3k views

Database connection from front end

I want to know why calling a database from the front end is considered a bad practice for security. It is really so bad as to justify building an application layer with all its drawbacks: costs, ...
1
vote
1answer
216 views

SQL Server Asymmetric Encryption Keys

I have used SQL Server database with data to be encrypted and I will use symmetric key for encryption and will encrypt it by asymmetric key now comes the question how to give user permission to ...
1
vote
1answer
53 views

Are sqlcmd parameters inherently at risk of SQL injection?

The command line utility sqlcmd has a feature to allow parameter substitution, from command line parameters and environment variables. https://msdn.microsoft.com/en-us/library/ms188714.aspx If an ...
1
vote
1answer
29 views

How to extract data from hackyourself legal site with table and column information?

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data. http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT ...
17
votes
5answers
10k views

SQL field level encryption, how safe is it?

I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
1
vote
1answer
74 views

Store SHA256 in sql-server

I need to develop a payment gateway and I've just realized I need to store an HMAC_SHA256_V1 key for authentication operations. The way that this is done is: the browser calls a WCF service that ...
2
votes
0answers
48 views

ISO27001 compliance and perceived Risks using Microsoft SQL Server Azure 2016 [closed]

Introduction My company is currently undergoing ISO27001 compliance. I originally thought that this is a purely technical issue, with the merits of different solutions being weighed up on purely ...
4
votes
1answer
90 views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...
0
votes
1answer
79 views

How does Netsparker extract the version of SQL Server during a SQL injection?

We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities. However I am surprised as the injection query throw error for casting and the scanner ...
1
vote
3answers
54 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
3
votes
1answer
64 views

Practical security for an inexperienced database developer? (HIPAA)

Hopefully my question isn't too unique to be asked here, but I didn't find anything similar after some searching. As a relatively inexperienced developer (only one large project excluding this one ...
1
vote
1answer
66 views

Are sessions enough to protect a web app

Imagine this scenario: SQL record is created for user record ID is stored in session SQL record can be updated where session ID = SQL ID user can view data in SQL record where session ID = SQL ID ...
1
vote
3answers
72 views

Is opening an SQL server insecure?

I need to be able to remotely modify my SQL database. There are two ways: A PHPMyAdmin like interface (write scripts which will do it) Let the SQL Server through the firewall (so it listens on the ...
3
votes
1answer
265 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
1
vote
1answer
182 views

Does using ASP.NET prevent XSS [duplicate]

I was reading about XSS, and I know that ASP.NET doesn't allow saving HTML to database. So my question is Does using ASP.NET make my web application secure regarding XSS completely, without ...
0
votes
1answer
88 views

SQL Injection via table name?

Is it possible to perform SQL injection on a query where the name of the table is passed in as an argument? The user doesn't enter the table name themselves, but it can be inferred through element ...
2
votes
2answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
1
vote
3answers
51 views

What is a typical defense mechanism/setup against flooding back-end sql calls?

I'm interested in figuring out what is a typical scenario of preventing the following attack scenario: Back-end has as SQL server. Front end a simple "Hello World" HTML that passes an input (say user ...
2
votes
1answer
221 views

How to encrypt columns in a database and be able to easily change encryption key

I have several fields in a database table I would like to encrypt, but I would like to do it in a way that would allow me to easily change the encryption key every n months for security reasons. My ...
0
votes
1answer
164 views

Saving username and pasword inside SQL

I am currently managing a network of around 100 PCs. Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications, ... When an application ...
2
votes
2answers
481 views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
0
votes
1answer
79 views

SQL Server Format-Preserving encryption

I have old system with database that has table with column of type char(20) and the customer decided to encrypt that column for some business needs however for some system integration needs the ...
44
votes
4answers
7k views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
1
vote
1answer
330 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
9
votes
4answers
853 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
1
vote
2answers
739 views

SQL Injection Issue Multi-line query

I am currently doing a SQL Injection attack against a website in school(that the tech created) sadly I can't point anyone to the site in question, the teacher has allowed us to gain knowledge as ...
0
votes
2answers
193 views

SQL injection at work [closed]

We have a web form that can be filled out with text fields and then they get emailed to us at work. Today we got some SQL commands it looks like in a bunch of emails. I just would like to have a bit ...
-1
votes
2answers
495 views

How to use ORM correctly to prevent SQL injection?

I read here that using ORM (like nHibernate) does not necessarily prevent SQL injection; for example, if you keep creating dynamic queries using your ORM framework you are still vulnerable. Fine, ...
0
votes
0answers
227 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
1
vote
0answers
97 views

Right security architecture for SQL Server access in a distributed Windows-based system [closed]

I am designing a software product for which multiple SQL Server databases will be accessed by multiple applications residing in different Windows environments. Some of the environments are process ...
17
votes
5answers
3k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
-1
votes
1answer
256 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
2
votes
1answer
1k views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
1
vote
2answers
405 views

Wireshark displays sql calls - Prevention

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
2
votes
2answers
242 views

Should I use a separate SQL Server instance for a database with PII?

We build software which needs a SQL SERVER database. This database will hold private user information (address,bank, ...) My question is: Should I install my database in a fresh SQL Server ...
1
vote
0answers
90 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
2
votes
1answer
111 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
3
votes
1answer
335 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
3
votes
0answers
25 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
4
votes
4answers
4k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
4
votes
3answers
367 views

What is a good rebuttal to users who wish all data WITHIN Db be encrypted?

I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend. The application is to track employee's money they defer each paycheck, or month, to deposit into separate ...
1
vote
1answer
514 views

Securing an IIS application with a complex configuration

I'm in a bit of a pickle. I've got an IIS application which accesses an SQL database (on a different machine). This already means that: a) the IIS application needs to have a connection string to ...
0
votes
2answers
402 views

Any residual effects after SQLMAP has been run?

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, ...
1
vote
1answer
94 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
3
votes
4answers
336 views

Are these SQL injection checks a bad idea?

Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward. I'm no security expert--but ...
1
vote
0answers
238 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
4
votes
1answer
862 views

Should we bother with cell-level encryption for an ASP.NET/SQL Server web application?

(Cross-posting this here on the advice of a user at stackoverflow...) Got a philosophical security question for everyone. I'm sketching out an ASP.NET web application design where sensitive data for ...