Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [databases]

Security related aspects of databases and database access.

3
votes
2answers
71 views

Store database access password in PHP class const?

I have PHP project and I need to store MySQL access information. I have a config.php file outside public directory and in the file I have: class Config { const host = "dbserver"; const name =...
1
vote
0answers
34 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
1
vote
0answers
22 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
1answer
49 views

hiding emails in database [closed]

I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
0
votes
0answers
13 views

Paypal api saving client id and secret

I am developing a web application (It is a point system, users do certain things and they receive points for it and I am using Wordpress for it) in php and I wanted to ask what is the best way to ...
15
votes
5answers
414 views

Business founder wants access to database but has no DB skills

Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
1
vote
0answers
29 views

Web application secrets protection following code execution

I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
0
votes
0answers
24 views

Accessing sensitive database through public analysis to preserve privacy

I'm exploring a solution that would allow large technology companies to allow access to their database for analysis, in a way that would protect the privacy of its users. I would love feedback on the ...
1
vote
0answers
21 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
1answer
62 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
1
vote
1answer
142 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
3
votes
1answer
49 views

Security consequences of a publicly accessible database?

I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
0
votes
0answers
29 views

Query encrypted database data with .NET Core and MS SQL Server

In a .NET Core application, we are storing chat conversations in the database. Currently we encrypt data using AES encryption. Things work out fine when storing and reading single values, but now we ...
0
votes
1answer
42 views

How to securely load data to a database in vendor server such that vendor does not see raw data at all?

Scenario: client will be uploading files with sensitive information to a vendor server for loading into a database. Due to the confidential nature of the files, the client does not want any archiving ...
0
votes
0answers
40 views

How to find accounts in leaked databases based on the domain name in the email address?

I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
-1
votes
1answer
47 views

Local File Download(LFD) vulnerability exploit

I have found a arbitrary file download vulnerability in an asp.net application. I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
1
vote
2answers
128 views

Database Pentest methodology or list? [closed]

I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
1answer
26 views

What are design and security considerations for a site that connects to its users' own dbs?

I'm envisaging a website where a user signs up, has their own database running somewhere, then provides credentials to the website so that website can access that database. For example, if I was the ...
1
vote
2answers
58 views

Storing customer data securely (compliance)

I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do. ...
2
votes
2answers
77 views

Should I implement access control on databases inside a trusted network?

Excerpt from Redis' security article: Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance ...
0
votes
1answer
82 views

Is it possible to get data from database server if you are on the application server?

For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
1
vote
1answer
151 views

Can you tell me if my design is secure?

I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows. I'm running three ...
6
votes
2answers
548 views

How dangerous is disclosing a table's structure to users?

I apologize if this is a dumb question. I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
2answers
111 views

Restricting source code exposure

Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them. Also, say you want to keep certain files inaccessible to people ...
1
vote
2answers
84 views

How helpful is encrypting/decrypting information on an app-server, and sending it to the database encrypted?

I just added some code to our app server to encrypt personal information before it's stored in the database. This was mostly done for compliance reasons, but how much of an actual security win is it? ...
-1
votes
1answer
132 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
1
vote
2answers
367 views

Bcrypt data type and length?

I'm using the following library for hashing my password. string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow"); The length is apparently 60 each time. My question is, I'm planning to ...
8
votes
5answers
690 views

Should I authenticate user on every request?

I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or ...
-1
votes
1answer
104 views

How to securely generate and store the salting for password hash? [duplicate]

Assume a client authenticates using the password, which includes hashing and salting. The hash values are stored in a remote database server. Questions: For the hash values stored in the database ...
1
vote
1answer
88 views

dangers of using WAMPServer on my home PC?

Hello there I have been working on (learning) web development and have gone down the route of self hosting at the moment. I have a website which I've made, it doesnt have any user interface for input, ...
2
votes
3answers
157 views

Partitioning database to enhance security/anonymity?

The goal here is to prevent identification of the users and their data. Is it a good idea to partition my database into multiple ones, one for each kind of sensitive data, hiding the links between ...
4
votes
1answer
355 views

Retreiving Google Chrome passwords

While retrieving Google Chrome passwords on macOS, I've noticed that the passwords all come up as the same thing (something along the lines of): Vi??M!4NNn. How I retreived them was with the following ...
0
votes
1answer
73 views

Tokenization - Is it bad practice to reuse tokens?

If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens? For example, if I am storing the name "Richard" multiple times, and ...
40
votes
8answers
8k views

Does password-protecting a database living next to the application add any security?

I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text. What are the benefits of such a setup over a ...
0
votes
2answers
97 views

Cryptography in simple words anout one idea?

I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing ...
-1
votes
1answer
277 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
0
votes
1answer
89 views

Database logs have multiple “Logon Login failed for user” from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
0
votes
0answers
31 views

Clarification on authentication tokens

This question is split into multiple questions which - at least over on SO - is frowned upon, but it boils down to one main question, which is: what's the correct way to use authentication tokens? ...
3
votes
1answer
307 views

Are MariaDB's encryption and compression functions secure?

MariaDB [(none)]> SET @key_str = SHA2('Is it secure?',512); Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]> SET @crypt_str = AES_ENCRYPT('cleartext',@key_str); Query OK, 0 rows affected (...
0
votes
0answers
28 views

Security of password to database in 2-layer SW model

I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly. This of course mean that the ...
3
votes
1answer
1k views

Does it make sense to encrypt database to comply with GDPR?

I had a hard time phrasing the question. I'd rather ask, "How do I comply with GDPR?" But that would probably be too broad of a question. Database encryption concerns me the most, since that's what ...
3
votes
3answers
163 views

What is the benefit of the database's information_schema for a hacker?

What is the benefit of the database's information_schema for a hacker? I am talking about SQL injection exploitation.
60
votes
7answers
12k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
3
votes
2answers
182 views

Depleted DB User Connections leads to DoS

I want to ask you for clarification and advice regarding the following situation that emerged during a penetration test of my client's eCommerce shop. My client is using an xt:commerce shop software ...
0
votes
0answers
81 views

Accessing MySQL DB from Java App or Apache Kafka and NiFi

I am wondering, what is more secure to access a database in MySQL: directly via Java application (DriverManager.getConnection) send information from Java App to Apache Kafka, then read it out in ...
2
votes
2answers
625 views

What is the best practice to save encrypted data to a database?

If I am to store different types of sensitive data, let's say: field1 in Table A and field2 in Table B and the data is unrelated, should I use a different key for each field? Add information 1: The ...
1
vote
0answers
183 views

Secure local database or service

I’m trying to secure a database of questions and I wonder if it’s actually possible. There are 2 ways the client (mobile App) can get questions: Local DB within the app. Service that returns ...
3
votes
2answers
123 views

preventing SQL injection with string length [duplicate]

This is far from best practice, but I just saw a piece of code that I found very interesting to say the least. The code was executing some SQL, and it was not using prepared statements so it is wide ...
1
vote
1answer
336 views

Storing basic financial data

I'm working on a project similar-ish to a budgeting app like mint or ynab. I'll be using the Plaid api, which abstracts away account/routing numbers, etc. Thus, what I'll have access to, and be trying ...
3
votes
1answer
332 views

Validate database column and table names to prevent SQLi?

There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of ...