Hot answers tagged mysql
19
I am not aware of any published cryptanalysis on MySQL OLD_PASSWORD(), but it is so weak that it is kind of a joke. It could be given as an exercise during a cryptography course.
Update: a cryptanalysis similar to the meet-in-the-middle described below was published in F. Muller and T. Peyrin
"Cryptanalysis of T-Function-Based Hash Functions"
in ...
18
Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services.
Firewall - Limit access by IP address to only the servers / clients that require access.
User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead ...
17
"None of us are security experts" and "I wouldn't feel comfortable with a company storing my credit card information in this manner" are completely valid arguments. From a technical perspective (on the merits), they ought to end the discussion. But if you're arguing with folks who are not security experts, they may not be in a position to recognize good ...
14
In PHP you cannot stack querys with a semicolon. However you can nest a query into another with parentheses (commonly called subqueries), e.g.:
SELECT * FROM vulnerable_table WHERE id = (SELECT number from other_table)
Using this technique (disregarding whether you output your SQL result or not) a keen attacker may extract all data from your database.
...
14
You've come to the right place. Welcome to IT security!
is there any sql injection for this code?
Yes
if there is what is that Entry?
username: [any username from your website]" /*
password: sux0r")*/ OR ("1"="1
It will run this query:
SELECT * FROM `config`
WHERE `config_admin_username`="[any username from your website]" /*
AND ...
13
There isn't a good answer. But here are your possibilities:
Tie the encryption key to your admin login (e.g. encrypt the the encryption key with your admin login). This is only marginally useful as it requires you to be logged in in order to encrypt/decrypt anything. But on the plus side, no one can encrypt/decrypt anything unless you're logged in (i.e. ...
13
Storing card numbers means you must comply with the requirements of PCI-DSS, or you risk fines and breach of your merchant account contract. PCI-DSS has an enormous set of requirements - some sensible, some onerous, some of questionable usefulness - and the cost of complying with it, and certifying that you've complied with it, can be very high.
Download ...
12
Generally hashing and encryption are for two different things. The main distinction in your case is that hashing is one way, and encryption is two-way. That is, you can decrypt the password to get them in plain text, but you cannot "de-hash" something.
If your system gets compromised and you are using encryption, the attacker will probably have all the ...
12
You should use prepared statements to prevent SQL injections. Take a look at this question.
However, $_SERVER['REMOTE_ADDR'] should be a valid IP address as it comes from the server, as verified by the TCP handshake. See this question for an extended discussion on this.
12
The MySQL root user is an account inside the database only. It is called root because it is the most privileged user on the database server, and has access to everything. The root user on Linux (or any other Unix) is a completely separate thing.
The maximum privilege that a MySQL user can have is equal to the privilege that the MySQL daemon runs at. On most ...
12
The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions.
You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...
11
To get started, you're probably going to want to focus on two things:
Securing your web server
Security your website
That's really two different specialties, and I don't think I'm going to be able to dig up a single document describing both... the ardent security nerd would also point out that this assumes you're working in a secure network with decent ...
10
Summary. Yes, the issue is that, in some character encodings (like UTF-8), a single character is represented as multiple bytes. One way that some programmers try prevent SQL injection is to escape all single quotes in untrusted input, before inserting it into their SQL query. However, many standard quote-escaping functions are ignorant of the character ...
9
This is really a pretty stinking huge question. Based on your chosen tags it looks like you're asking for guidance on a LAMP stack, so we'll focus on that. There are already a number of related hardening questions posted, so for some additional insights check out these questions:
MySQL Server Hardening
Hardening Linux Server
What are the best practices for ...
9
Don't implement your own session handler. Use $_SESSION, it was written and audited by people who very good understanding security. I don't even know the intricacies of how your session handler works, but based on the little information you have given us its insecure.
SQL Injection is useful to obtain data from the database. We HASH passwords because ...
9
It is very good that the mysql server is not required to support remote connections because it greatly reduces the attackable surface.
But you should consider defence in depth as a strategy to slow down an attacker or even reduce the impact of an attack.
Setting up a good password for the database users is no significant amount of work, so you should do ...
8
You should never put the password in the code. In general your connection settings live outside the compiled application code; for C# that would generally be in an app.config XML file, encrypted if need be.
But either way, if the application is able to make direct connections to the database, it has to know the password, and there is nothing you can do to ...
8
Yes, for several reasons.
One, someone with read access to the binary could potentially run the strings command and look for likely possibilities near the phrase 'localhost'.
Two, if you ever decide to use the program elsewhere, you currently have the options of 1) setting up the exact same database on localhost with the exact same username and password ...
8
I find that ' or 1=1-- is useful in less than 1% of sql injection that I come across, this payload is commonly seen in SQL Injection examples because it is a very simple statement. The problem that you are most likely experiencing is that your comment is incorrect. The -- needs to follow by a single space or it is not actually a comment, so ' or 1=1-- 1 is ...
7
You are extending your trust to outsiders beyond your subnet neighbors.
By default, MySQL uses unencrypted connections between the client and the server. This means that someone with access to the network could watch all your traffic and look at the data being sent or received. They could even change the data while it is in transit between client and ...
7
If your company is in any way a part of regulations requiring security (like SOX or HIPPA in the US) or trade standards (like PCI or various ISO standards), all you have to do is tell them that:
you've found holes that could let anyone download the entire database and network (stretch the truth a bit if you have to sell it, and remind them of the ACS:Law ...
7
You tell them what you know, and then you let them make the decision they want to make. Unless you've been hired to do their PCI audit, this probably isn't your fight. Put together a report explaining the relavant threats and potential issues so that both you and they have it in writing, and then you're done. Specifically, you may want to let them know what ...
7
The mere fact your DB ran the quoted queries (throwing you the error reports) means you do have injection vulnerability in PHP code. Note, that some methods of inspecting DB tables structure involve running multiple queries with different parameters until DB throws an error and HTML page breaks. That means the failed queries are only tip of iceberg of all ...
7
I had some fun "decoding" two queries, so here's how I did it in PHP :p
1) or 1=convert(int,(select cast(Char(114)+Char(51)+Char(100)+Char(109)+Char(48)+Char(118)+Char(51)+Char(95)+Char(104)+Char(118)+Char(106)+Char(95)+Char(105)+Char(110)+Char(106)+Char(101)+Char(99)+Char(116)+Char(105)+Char(111)+Char(110) as nvarchar(4000))))--
So let's start with ...
6
I suppose the usual OS methods (including fail2ban if remote ssh admin is required), then block all external access to the MySQL port, or allow a whitelist to connect if absolutely necessary. Set a password for the mysqladmin user.
After that, the mysqladmin user should only be allowed to connect from localhost and should be the only user granted any ...
6
For trade shows, do you HAVE to connect to your live database ? Could you make do with a (recent) copy on a local machine.
The additional risks at a trade show are that you are surrounded by competing companies who would have a commercial interest either in your data or in making your application unavailable (crashing the server). There's also more ...
6
It sounds like you've got a decent grasp on threats, know that what you're doing now is preferable from a security standpoint, and are facing a cost / benefit analysis. With that in mind, here are some alternate thoughts:
Configure MySQL with an SSL frontend. There are some features in MySQL for that, but stunnel may make you less crazy. While client ...
6
Always use parameterized queries, string concatenation leaves room for error, stop leaving that room (they also look a lot nicer).
Also, because id is an int, I don't need quotes to inject:
$id = '0; Drop Table myTable;--';
$sql = "SELECT * , COUNT( * ) AS amount
FROM articles
WHERE id = 0; Drop Table myTable;--
GROUP BY id";
I ...
6
Public / private key encryption is slow. It's ideal for write it & forget it, but it's not a fast process.
For the sake of speed, consider this: use a randomly generated symmetric key that is chosen when the daemon starts and possibly is rotated out every hourly, daily, weekly, or monthly (depending on your traffic and security needs). Leave that key in ...
Only top voted, non community-wiki answers of a minimum length are eligible
