Tag Info

New answers tagged


If it's not needed, it should be closed. Vulnerabilities You can never be sure if there are no vulnerabilities in MySQL itself. Here is an example for a DOS attack (and it's not the only possible attack). Allowing non-ip restricted remote access to MySQL Allowing remote access to MySQL is not a vulnerability by itself, but there are scenarios where it ...


Just opening the port isn't intrinsically any more dangerous that opening a SSH port. The problem is that any application program that could USE the port could be hacked, and then be used to compromise your database. Anything running on the client side is inherently not to be trusted.


Assuming your server doesn't use any credentials besides system-level accounts and the MySQL password, there's one thing you need to protect: the swap file. Programs are supposed to take steps to prevent credentials from winding up in swap, but they don't always do so. There are some sensitive things in /dev and /proc (such as /dev/mem and /proc/kcore). ...


You can insert a subquery in place of the injection point. For starters in case of mysql Select concat(version(),user(),database()) Select grantee from information_schema.USER_PRIVILEGES Also check out for sql-map tool


The various authentication methods of MySQL are publicly documented in the manual: http://dev.mysql.com/doc/internals/en/authentication-method.html What you describe might be a method called Secure Password Authentication.

Top 50 recent answers are included