0

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect the organization that I work for from nefarious SQL injections or data leakage. I would appreciate if anybody can provide links to the documents/books/queries/tools that are applicable in current environment.

closed as too broad by Steffen Ullrich, Tobi Nary, Anders, schroeder Jan 22 at 7:37

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    DBMS's are not to blame for SQL Injections nor data leakage. Web apps, faulty authentication and/or bad passwords are. VTC'd. – Tobi Nary Jan 22 at 6:23
1

I am not sure that I understand your requirements, so I will assume you want to prevent offering vulnerabilities to nefarious actors, rather than pen-testing until doomsday. Further assumptions: - You are connected enough with your organization to review source code with the developers.

I would start with the OWASP recommendations.
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

Much of this will rely upon scanning the source code rather than rigging up a framework to feed your databases sketchy queries. Please let me know in comments if this is NOT what you mean, or if your INFOSEC group is not tied in with the developers.

Not the answer you're looking for? Browse other questions tagged or ask your own question.