SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

learn more… | top users | synonyms

44
votes
4answers
7k views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
17
votes
5answers
10k views

SQL field level encryption, how safe is it?

I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
17
votes
5answers
3k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
12
votes
3answers
7k views

How secure is the traffic with Sql Server Management Studio?

I was just using Sql Server Management Studio on my WiFi, and I was actually wondering how secure the traffic/database communication is. Is traffic from querying secure, or is it easily sniffed for ...
10
votes
1answer
6k views

Is an encrypted connection to MS-SQL Server really safe?

Quick intro: Small company, VERY limited resources. I pretty much do everything including coffe. I am a programmer, not a security guy. That's why i ask you... We have an MS-SQL 2008 Database ...
10
votes
2answers
1k views

Online SQL Server database for a Business app. Security considerations

A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
9
votes
4answers
854 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
7
votes
3answers
2k views

IIS and SQLServer Hardening

long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
6
votes
1answer
608 views

SQL Server of my hosting provider allows me to see all databases. How secure is my mine?

My hosting provider allows access to its SQL Server. When I connected to it by SQL Management Studio, all hosted databases were visible. I can't get the details on these databases, I get this ...
5
votes
2answers
151 views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
5
votes
3answers
2k views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
5
votes
1answer
278 views

Using AD authentication in a publicly accessible webapp

I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql ...
4
votes
4answers
4k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
4
votes
3answers
367 views

What is a good rebuttal to users who wish all data WITHIN Db be encrypted?

I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend. The application is to track employee's money they defer each paycheck, or month, to deposit into separate ...
4
votes
2answers
216 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
4
votes
1answer
865 views

Should we bother with cell-level encryption for an ASP.NET/SQL Server web application?

(Cross-posting this here on the advice of a user at stackoverflow...) Got a philosophical security question for everyone. I'm sketching out an ASP.NET web application design where sensitive data for ...
4
votes
2answers
344 views

With full access to the disk of an IIS web server, could you access the database server?

Here is a theoretical setup: You have a web server running Windows Server with IIS You have a website running here which connects to a database This website can start automatically when the server ...
4
votes
1answer
90 views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...
4
votes
2answers
1k views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
3
votes
4answers
2k views

Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?

I'm working in a web site that doesn't use parameters on SQL queries. All the queries are adhoc and the way they are doing the input validation seems good to me, I'm not able to break it to do SQL ...
3
votes
4answers
336 views

Are these SQL injection checks a bad idea?

Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward. I'm no security expert--but ...
3
votes
2answers
720 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
3
votes
1answer
265 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
3
votes
1answer
335 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
3
votes
1answer
2k views

What can be used to keep xp_CmdShell in SQL Server disabled?

It's a well known fact that anyone with "SA" privs can turn on xp_CmdShell and use it and that includes any would-be attackers that can gain access to SQL Server as a login that has "SA" privs. There ...
3
votes
0answers
25 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
3
votes
1answer
64 views

Practical security for an inexperienced database developer? (HIPAA)

Hopefully my question isn't too unique to be asked here, but I didn't find anything similar after some searching. As a relatively inexperienced developer (only one large project excluding this one ...
2
votes
2answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
2
votes
1answer
2k views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
2
votes
2answers
242 views

Should I use a separate SQL Server instance for a database with PII?

We build software which needs a SQL SERVER database. This database will hold private user information (address,bank, ...) My question is: Should I install my database in a fresh SQL Server ...
2
votes
2answers
198 views

E-mail Server Security

In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
2
votes
2answers
358 views

Time based event, console application on Windows Server — security implications

I'm a software engineer, and I've written several discreet utilities that run at specific times on Windows Server 2008. Generally speaking, they are console applications, need to access SQL Server, ...
2
votes
1answer
1k views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
2
votes
1answer
111 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
2
votes
2answers
875 views

Least insecure way to encrypt a field in the database so that it can still be included in queries

I have a table where all columns need to be encrypted (aside from the PK). This will be achieved using AES at the application level. However there is one particular field that needs to remain ...
2
votes
2answers
2k views

Sqlmap fails at enabling xp_cmdshell procedure

I have been browsing the web looking for some help regarding the following issue. I am currently performing an web application penetration test, and I had come accross a beautiful blind SQL Injection. ...
2
votes
2answers
803 views

Implications of using domain\computername$ account to serve SQL data to IIS

One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5). The application connects to a SQL Server database back-end ...
2
votes
1answer
223 views

How to encrypt columns in a database and be able to easily change encryption key

I have several fields in a database table I would like to encrypt, but I would like to do it in a way that would allow me to easily change the encryption key every n months for security reasons. My ...
2
votes
1answer
539 views

Does SQL Server CE 4 decrypt data securely?

I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.) When the ...
2
votes
1answer
197 views

Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol

Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head. Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
2
votes
0answers
49 views

ISO27001 compliance and perceived Risks using Microsoft SQL Server Azure 2016 [closed]

Introduction My company is currently undergoing ISO27001 compliance. I originally thought that this is a purely technical issue, with the merits of different solutions being weighed up on purely ...
2
votes
2answers
482 views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
2
votes
0answers
2k views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
1
vote
1answer
182 views

Does using ASP.NET prevent XSS [duplicate]

I was reading about XSS, and I know that ASP.NET doesn't allow saving HTML to database. So my question is Does using ASP.NET make my web application secure regarding XSS completely, without ...
1
vote
2answers
719 views

Microsoft SQL server 2000 sp3a - isn't it oudated?

I just noticed that many servers use Microsoft SQL server 2000. But isn't 2000 outdated by 2003? Why are people still using 2000? Would there be any serious security vulnerability by using Microsoft ...
1
vote
2answers
322 views

Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server. Here we have to work with facebook Payment API. We need to secure enough our ...
1
vote
1answer
367 views

Safe to store access details in a session?

Background I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static ...
1
vote
3answers
51 views

What is a typical defense mechanism/setup against flooding back-end sql calls?

I'm interested in figuring out what is a typical scenario of preventing the following attack scenario: Back-end has as SQL server. Front end a simple "Hello World" HTML that passes an input (say user ...
1
vote
2answers
411 views

Wireshark displays sql calls - Prevention

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
1
vote
1answer
79 views

How to Protect SQL Server 2005?

My project's backend is SQL Server 2005 and I need to install this to customers' systems. The problem is when someone logs onto the computer, they can easily access the SQL Server with Windows ...