Questions tagged [databases]
Security related aspects of databases and database access.
3
votes
2answers
71 views
Store database access password in PHP class const?
I have PHP project and I need to store MySQL access information.
I have a config.php file outside public directory and in the file I have:
class Config
{
const host = "dbserver";
const name =...
1
vote
0answers
34 views
Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?
LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider.
Any input would be swell!
-
A case ...
1
vote
0answers
22 views
How should I secure my database in Microservice architecture
Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
1answer
49 views
hiding emails in database [closed]
I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
0
votes
0answers
13 views
Paypal api saving client id and secret
I am developing a web application (It is a point system, users do certain things and they receive points for it and I am using Wordpress for it) in php and I wanted to ask what is the best way to ...
15
votes
5answers
414 views
Business founder wants access to database but has no DB skills
Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
1
vote
0answers
29 views
Web application secrets protection following code execution
I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
0
votes
0answers
24 views
Accessing sensitive database through public analysis to preserve privacy
I'm exploring a solution that would allow large technology companies to allow access to their database for analysis, in a way that would protect the privacy of its users. I would love feedback on the ...
1
vote
0answers
21 views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
1answer
62 views
IP-whitelisting for DB access, does solution fit best practices?
All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
1
vote
1answer
142 views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
3
votes
1answer
49 views
Security consequences of a publicly accessible database?
I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
0
votes
0answers
29 views
Query encrypted database data with .NET Core and MS SQL Server
In a .NET Core application, we are storing chat conversations in the database. Currently we encrypt data using AES encryption. Things work out fine when storing and reading single values, but now we ...
0
votes
1answer
42 views
How to securely load data to a database in vendor server such that vendor does not see raw data at all?
Scenario: client will be uploading files with sensitive information to a vendor server for loading into a database. Due to the confidential nature of the files, the client does not want any archiving ...
0
votes
0answers
40 views
How to find accounts in leaked databases based on the domain name in the email address?
I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
-1
votes
1answer
47 views
Local File Download(LFD) vulnerability exploit
I have found a arbitrary file download vulnerability in an asp.net application.
I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
1
vote
2answers
128 views
Database Pentest methodology or list? [closed]
I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
1answer
26 views
What are design and security considerations for a site that connects to its users' own dbs?
I'm envisaging a website where a user signs up, has their own database running somewhere, then provides credentials to the website so that website can access that database. For example, if I was the ...
1
vote
2answers
58 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
2
votes
2answers
77 views
Should I implement access control on databases inside a trusted network?
Excerpt from Redis' security article:
Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance ...
0
votes
1answer
82 views
Is it possible to get data from database server if you are on the application server?
For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
1
vote
1answer
151 views
Can you tell me if my design is secure?
I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows.
I'm running three ...
6
votes
2answers
548 views
How dangerous is disclosing a table's structure to users?
I apologize if this is a dumb question.
I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
2answers
111 views
Restricting source code exposure
Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them.
Also, say you want to keep certain files inaccessible to people ...
1
vote
2answers
84 views
How helpful is encrypting/decrypting information on an app-server, and sending it to the database encrypted?
I just added some code to our app server to encrypt personal information before it's stored in the database. This was mostly done for compliance reasons, but how much of an actual security win is it?
...
-1
votes
1answer
132 views
Attempting SQLi against website with WAF filter [closed]
I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
1
vote
2answers
367 views
Bcrypt data type and length?
I'm using the following library for hashing my password.
string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow");
The length is apparently 60 each time. My question is, I'm planning to ...
8
votes
5answers
690 views
Should I authenticate user on every request?
I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or ...
-1
votes
1answer
104 views
How to securely generate and store the salting for password hash? [duplicate]
Assume a client authenticates using the password, which includes hashing and salting. The hash values are stored in a remote database server.
Questions:
For the hash values stored in the database ...
1
vote
1answer
88 views
dangers of using WAMPServer on my home PC?
Hello there I have been working on (learning) web development and have gone down the route of self hosting at the moment. I have a website which I've made, it doesnt have any user interface for input, ...
2
votes
3answers
157 views
Partitioning database to enhance security/anonymity?
The goal here is to prevent identification of the users and their data. Is it a good idea to partition my database into multiple ones, one for each kind of sensitive data, hiding the links between ...
4
votes
1answer
355 views
Retreiving Google Chrome passwords
While retrieving Google Chrome passwords on macOS, I've noticed that the passwords all come up as the same thing (something along the lines of): Vi??M!4NNn. How I retreived them was with the following ...
0
votes
1answer
73 views
Tokenization - Is it bad practice to reuse tokens?
If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens?
For example, if I am storing the name "Richard" multiple times, and ...
40
votes
8answers
8k views
Does password-protecting a database living next to the application add any security?
I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text.
What are the benefits of such a setup over a ...
0
votes
2answers
97 views
Cryptography in simple words anout one idea?
I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing ...
-1
votes
1answer
277 views
What does pseudonymization mean in the context of web development?
In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development.
The info I've read infers that it is ...
0
votes
1answer
89 views
Database logs have multiple “Logon Login failed for user” from different IPs
Background: I have an SQL Server database running on Amazon RDS
The AWS dashboard has a section for logs and whenever I check the logs I see the following:
2018-04-27 06:10:26.00 Logon Error: 18456,...
0
votes
0answers
31 views
Clarification on authentication tokens
This question is split into multiple questions which - at least over on SO - is frowned upon, but it boils down to one main question, which is: what's the correct way to use authentication tokens?
...
3
votes
1answer
307 views
Are MariaDB's encryption and compression functions secure?
MariaDB [(none)]> SET @key_str = SHA2('Is it secure?',512);
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> SET @crypt_str = AES_ENCRYPT('cleartext',@key_str);
Query OK, 0 rows affected (...
0
votes
0answers
28 views
Security of password to database in 2-layer SW model
I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly.
This of course mean that the ...
3
votes
1answer
1k views
Does it make sense to encrypt database to comply with GDPR?
I had a hard time phrasing the question. I'd rather ask, "How do I comply with GDPR?" But that would probably be too broad of a question. Database encryption concerns me the most, since that's what ...
3
votes
3answers
163 views
What is the benefit of the database's information_schema for a hacker?
What is the benefit of the database's information_schema for a hacker? I am talking about SQL injection exploitation.
60
votes
7answers
12k views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
3
votes
2answers
182 views
Depleted DB User Connections leads to DoS
I want to ask you for clarification and advice regarding the following situation that emerged during a penetration test of my client's eCommerce shop.
My client is using an xt:commerce shop software ...
0
votes
0answers
81 views
Accessing MySQL DB from Java App or Apache Kafka and NiFi
I am wondering, what is more secure to access a database in MySQL:
directly via Java application (DriverManager.getConnection)
send information from Java App to Apache Kafka, then read it out in ...
2
votes
2answers
625 views
What is the best practice to save encrypted data to a database?
If I am to store different types of sensitive data, let's say: field1 in Table A and field2 in Table B and the data is unrelated, should I use a different key for each field?
Add information 1:
The ...
1
vote
0answers
183 views
Secure local database or service
I’m trying to secure a database of questions and I wonder if it’s actually possible.
There are 2 ways the client (mobile App) can get questions:
Local DB within the app.
Service that returns ...
3
votes
2answers
123 views
preventing SQL injection with string length [duplicate]
This is far from best practice, but I just saw a piece of code that I found very interesting to say the least.
The code was executing some SQL, and it was not using prepared statements so it is wide ...
1
vote
1answer
336 views
Storing basic financial data
I'm working on a project similar-ish to a budgeting app like mint or ynab. I'll be using the Plaid api, which abstracts away account/routing numbers, etc. Thus, what I'll have access to, and be trying ...
3
votes
1answer
332 views
Validate database column and table names to prevent SQLi?
There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of ...
