Security related aspects of databases and database access.

learn more… | top users | synonyms (1)

1
vote
1answer
44 views

Pentesting a Data Warehouse?

One client has recently implemented AWS and has a EC2 instance running. We have made one scoping call and further to that they provided me with a diagram that I have modified to avoid any issue: ...
2
votes
0answers
17 views

Is there a database with XSS vectors, possible reference and test information?

I recently had the idea to develop an public database in which unique XSS vectors will be registered and get a reference assigned similar to the CVE system. I made a local PoC already and registered ...
3
votes
2answers
318 views

Storing Password Hash plaintext

I've been doing some research on password hashing/salting. It is my understanding that the salt doesn't need to be secret. But I haven't read anything about the hash itself needing to be secret. How ...
0
votes
1answer
22 views

SecureData even for admins with external login

Given: A WebService which stores user Data and a server with a database. A Administrator which can acces the sever wit hthe webservice and the server with the database. Foreach user is a ...
-1
votes
0answers
7 views

Knowledge base solution access [on hold]

Presently working on a knowledge-based solution platform which I want to be accessed both online /offline via data and sms by searching keywords.... Please I need help with regards to the offline(sms) ...
1
vote
1answer
37 views

How secure is it to use ODBC Driver with SSL

When Connecting from clients (such as Windows) to remote databases such as (MS-SQL Server), it is usually advised that this connection be via a service that runs on the database server. It is ...
0
votes
3answers
93 views

Understanding a DMZ with multiple servers

I get the general principle of a DMZ i.e. place public facing servers in the DMZ to isolate and protect the corporate LAN. I have a web application which is to be public facing, this web app needs to ...
-4
votes
0answers
11 views

External email from specific database going to junk folder [migrated]

I have migrated from Exchange 2010 to Exchange 2013, after which things are okay. I have four server plus two databases as below: Servers: CAS01, CAS02, MBX01, MBX02 Database: DB1 mounted on MBX01 ...
3
votes
1answer
45 views

Are there open databases or sites similar to xssed.com, not necessarily about XSS?

Are there open databases, websites similar to xssed.com that are not necessarily about XSS, but where people report SQL inject-able websites or malware infected websites, for example? Potentially ...
0
votes
2answers
125 views

Weird table names in SQLite database

This is the first time I'm using sqlmap against SQLite. When I run: sqlmap -u www.site.com:80/index.php?vulnParametr=p --dump-all --keep-alive --dbms=sqlite It gives me this: What is that? Is ...
1
vote
1answer
53 views

How can I track IPs to block malicious users?

TL;DR: I want to know should I store both REMOTE-ADDRESS and X-FORWARDED-FOR or either REMOTE-ADDRESS or X-FORWARDED-FOR? Details... Here is a few theories to get user's IP Theory1: If you don't ...
0
votes
0answers
21 views

Using Nginx to block non-GET requests

I'm running a CouchDB instance on my server. A certain database within it (not the entire CouchDB instance) is exposed at a subdomain on my website via this Nginx configuration: server { listen ...
0
votes
2answers
38 views

DB Security from system admin perspective

I need some clarity in terms of Security involving Linux Admins and DBAs. Oracle DB on an Enterprise Linux server. I want to ensure none of the contractor team be able to tamper database and its ...
3
votes
3answers
93 views

Single web application - security advantages to two server model?

I'm looking to deploy infrastructure for a web application that will live on a LAMP stack. The infrastructure is such that this is the only application that will ever live on this server and it must ...
1
vote
1answer
27 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
16
votes
5answers
9k views

Would removing spaces in a string protect against SQL injection?

I was curious if it's possible to protect against an SQL injection attack by removing all spaces from an String input? I have been reading up on SQL Injection at OWASP, but they don't mention ...
0
votes
1answer
29 views

Is it possible using a file level encryption in addition to TDE in Microsoft SharePoint?

For Microsoft SharePoint, TDE is a great encryption solution to keep databases encrypted. I've tried to find a possible solution to encrypt the files once more using an other level of encryption on ...
0
votes
1answer
45 views

What more can I do to secure my service?

I run a multiplayer gaming service that provides a server list for clients and servers. At the moment it uses an SQLite database stored locally (which is insecure in itself). I am drawing up plans to ...
0
votes
2answers
127 views

I want to encrypt certain entries in a database. Is this a good plan?

I'm working on a web app and want to offer the users the option to "encrypt" their account. This wouldn't encrypt everything related to them in the database. Just certain critical fields. I've ...
0
votes
1answer
162 views

How does the ERAD device gain access to your personal bank account?

I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts. http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
1
vote
1answer
42 views

Limiting access to data in a web application from IPs outside the network

My goal is to build a system (PHP + MySQL) where a user will have access to particular data only when logged in locally (from one of the office computers with a local IP), and to all the non-sensitive ...
-3
votes
2answers
97 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
0
votes
0answers
41 views

Best way to store SQLite password offline? [duplicate]

I'm developing a Windows application that uses SQLite, and I want to encrypt it (there is some sensitive information). The trouble is that one of the application requirements is that it must work ...
3
votes
2answers
52 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
-4
votes
1answer
88 views

Safest SQL database [closed]

I am going to run a Tor Hidden Service on a Linux server. My site will have an SQL database. This DB contains user login, and a few other basic details. If it makes a difference depending on the ...
6
votes
4answers
389 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
3
votes
2answers
85 views

What are the best practices for trusting connection sources in open source software?

Quite concise, but I'll elaborate with an example: Lets say I have a simple app written in C# and i want to know how many people a day open the app. the easiest solution would be to simply have a ...
1
vote
1answer
97 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
6
votes
0answers
51 views

Why would I use at-rest encryption over a DB's key-based encryption?

Goal I want to store encrypted data in a database. Constraints Application-level encryption (encrypting before sending to the DB) is not a reasonable option for my use case. The DB providers I'm ...
0
votes
1answer
78 views

MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?

I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server. ...
0
votes
3answers
53 views

Denial of Service by SQL queries - are selective queries better than queries that return a lot?

Lets say I have a search form for a blog (or any other system that would use SQL to run queries) and I want to protect it from denial of service. An attacker wants to attack my site by flooding the ...
6
votes
4answers
109 views

How can releasing the text of an SQL query compromise security?

I have asked a government agency, under Freedom of Information legislation, to release two SQL queries they ran to produce a table which they published in a report. That is, the agency published ...
0
votes
3answers
92 views

Is it a good idea to let a database do a password check?

Setup A server running a PostgreSQL database and an Apache with several php applications. Access to db is over the loopback interface. The db contains a table with the username and SHA-512-CRYPT ...
0
votes
1answer
150 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
4
votes
1answer
142 views

Safely store passwords in specific scenario

I have a specific network environment. Its a DTN(Delay Tolerant Network) network without continous connectivity, situated on the sea, where nodes are ships. There is also a server that is a part of ...
-8
votes
4answers
171 views

Why shouldn't I store passwords in plaintext? [closed]

Why is it so important not to save passwords in plaintext? I think it is the same issue like authorizing a user on a RESTful webservice, where most developers claim: "Don't send your security token ...
1
vote
0answers
25 views

Hosting companies by AS Number [closed]

Is there any website out the like bgp.he.net(Hurricane Electric) or ipv4info.com that has a database with all VPS/Dedicated Server comapnies filtered by AS Number? I know that there are plenty of ...
2
votes
0answers
26 views

Is it a bad practice to not use a separate database server? [duplicate]

An isolated environment for just the application data sounds good, but does it have a significant security advantage compared to the everything-in-one-place model?
34
votes
4answers
5k views

Is using a DB prefix for tables more secure?

I see systems that use database prefixes. Some call it a security feature. Some call it a way to have multiple installations in one database. The main pro is that it's harder to guess the whole table ...
-5
votes
1answer
155 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
0
votes
3answers
95 views

How many backups should I keep?

Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups. ...
0
votes
3answers
124 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
1
vote
0answers
29 views

AWS DMS to use CloudHSM

I have a source database that need to be migrated to another one. This target will be created and integrated with CloudHSM so that the data migrated is encrypted. For migration I am planning to use ...
6
votes
2answers
155 views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
2
votes
2answers
70 views

Is it safe to reveal table column names in ajax?

I have a table like... THINGS_TABLE ============ thing_key int PRIMARY KEY thing_num varchar(20) thing_title varchar(20) thing_description varchar(20) And ...
1
vote
1answer
188 views

How make SQL select query without comma? [closed]

I am trying SQLi and comma was filtered there. How make SELECT SQL request without a comma?
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
1
vote
1answer
94 views

Store SHA256 in sql-server

I need to develop a payment gateway and I've just realized I need to store an HMAC_SHA256_V1 key for authentication operations. The way that this is done is: the browser calls a WCF service that ...
6
votes
3answers
118 views

Is there any concern regarding a database primary key exposure? [duplicate]

Is there any risk if for example I let to end users to know the primary key associated to users in the database?
0
votes
1answer
42 views

Are there attacks to steal database records from memory in cloud?

Imagine a hosted database in public cloud. The database records are encrypted only on disk (data-at-rest). Are there are any attacks that steal the database records from the memory (when queries are ...