I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect the organization that I work for from nefarious SQL injections or data leakage. I would appreciate if anybody can provide links to the documents/books/queries/tools that are applicable in current environment.

  • 3
    DBMS's are not to blame for SQL Injections nor data leakage. Web apps, faulty authentication and/or bad passwords are. VTC'd. – Tobi Nary Jan 22 '19 at 6:23

I am not sure that I understand your requirements, so I will assume you want to prevent offering vulnerabilities to nefarious actors, rather than pen-testing until doomsday. Further assumptions: - You are connected enough with your organization to review source code with the developers.

I would start with the OWASP recommendations.

Much of this will rely upon scanning the source code rather than rigging up a framework to feed your databases sketchy queries. Please let me know in comments if this is NOT what you mean, or if your INFOSEC group is not tied in with the developers.

Not the answer you're looking for? Browse other questions tagged or ask your own question.