Questions tagged [databases]
Security related aspects of databases and database access.
1
vote
2answers
65 views
Is it legal to store users searches [on hold]
Im developing a webshop and i got a task asking for storing users searches. Is it legal?
It will be stored in a db with the fields Date, Search text, userId
1
vote
1answer
38 views
Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?
Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program.
There's a problem with this, and that's that it ends up in ...
1
vote
2answers
145 views
How to obfuscate a relation between two tables in a database?
I have a kind of weird use case here, and I'm not sure how to deal with it.
I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't ...
0
votes
1answer
30 views
Storing files in database through encryption and Viewing them only on providing key for the file
I have this use case:
User1 uploads his file into the database which should be encrypted.
Any other users who request that file, user1 will be notified for approval, on approving other users should ...
0
votes
1answer
39 views
What would be the best way to evaulate the database management systems? [closed]
I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
33 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
2
votes
2answers
317 views
Is it worth storing email addresses as hashes?
If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes.
Is it worth storing email ...
0
votes
0answers
55 views
Introduce a SQLi in a testing application
So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
432 views
Is forbiding the ; char enough to prevent SQL injection?
Disclaimer: Parameterized queries are the way to go, no need to discuss about that :)
I've seen the following code at a friends place:
var query = "SELECT * FROM students WHERE name = " + name;
...
0
votes
1answer
57 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
0
votes
1answer
26 views
Prevent Database from accessing with knowing system admin user [closed]
My question might be broad. Suppose that we trying to store our client's information data with a database on a server. The server may get a vulnerability and give access to a hacker to get access to ...
3
votes
2answers
87 views
Store database access password in PHP class const?
I have PHP project and I need to store MySQL access information.
I have a config.php file outside public directory and in the file I have:
class Config
{
const host = "dbserver";
const name =...
1
vote
0answers
37 views
Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?
LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider.
Any input would be swell!
-
A case ...
1
vote
0answers
26 views
How should I secure my database in Microservice architecture
Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
1answer
52 views
hiding emails in database [closed]
I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
15
votes
5answers
427 views
Business founder wants access to database but has no DB skills
Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
1
vote
0answers
29 views
Web application secrets protection following code execution
I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
0answers
21 views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
1answer
75 views
IP-whitelisting for DB access, does solution fit best practices?
All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
1
vote
1answer
171 views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
3
votes
1answer
52 views
Security consequences of a publicly accessible database?
I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
0
votes
1answer
43 views
How to securely load data to a database in vendor server such that vendor does not see raw data at all?
Scenario: client will be uploading files with sensitive information to a vendor server for loading into a database. Due to the confidential nature of the files, the client does not want any archiving ...
0
votes
0answers
76 views
How to find accounts in leaked databases based on the domain name in the email address?
I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
-1
votes
1answer
70 views
Local File Download(LFD) vulnerability exploit
I have found a arbitrary file download vulnerability in an asp.net application.
I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
1
vote
2answers
291 views
Database Pentest methodology or list? [closed]
I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
1answer
26 views
What are design and security considerations for a site that connects to its users' own dbs?
I'm envisaging a website where a user signs up, has their own database running somewhere, then provides credentials to the website so that website can access that database. For example, if I was the ...
1
vote
2answers
59 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
2
votes
2answers
79 views
Should I implement access control on databases inside a trusted network?
Excerpt from Redis' security article:
Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance ...
0
votes
1answer
84 views
Is it possible to get data from database server if you are on the application server?
For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
1
vote
1answer
153 views
Can you tell me if my design is secure?
I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows.
I'm running three ...
6
votes
2answers
562 views
How dangerous is disclosing a table's structure to users?
I apologize if this is a dumb question.
I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
2answers
115 views
Restricting source code exposure
Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them.
Also, say you want to keep certain files inaccessible to people ...
1
vote
2answers
85 views
How helpful is encrypting/decrypting information on an app-server, and sending it to the database encrypted?
I just added some code to our app server to encrypt personal information before it's stored in the database. This was mostly done for compliance reasons, but how much of an actual security win is it?
...
-1
votes
1answer
164 views
Attempting SQLi against website with WAF filter [closed]
I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
1
vote
2answers
559 views
Bcrypt data type and length?
I'm using the following library for hashing my password.
string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow");
The length is apparently 60 each time. My question is, I'm planning to ...
8
votes
5answers
733 views
Should I authenticate user on every request?
I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or ...
-1
votes
1answer
105 views
How to securely generate and store the salting for password hash? [duplicate]
Assume a client authenticates using the password, which includes hashing and salting. The hash values are stored in a remote database server.
Questions:
For the hash values stored in the database ...
1
vote
1answer
180 views
dangers of using WAMPServer on my home PC?
Hello there I have been working on (learning) web development and have gone down the route of self hosting at the moment. I have a website which I've made, it doesnt have any user interface for input, ...
2
votes
3answers
166 views
Partitioning database to enhance security/anonymity?
The goal here is to prevent identification of the users and their data. Is it a good idea to partition my database into multiple ones, one for each kind of sensitive data, hiding the links between ...
5
votes
1answer
524 views
Retreiving Google Chrome passwords
While retrieving Google Chrome passwords on macOS, I've noticed that the passwords all come up as the same thing (something along the lines of): Vi??M!4NNn. How I retreived them was with the following ...
0
votes
1answer
78 views
Tokenization - Is it bad practice to reuse tokens?
If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens?
For example, if I am storing the name "Richard" multiple times, and ...
40
votes
8answers
8k views
Does password-protecting a database living next to the application add any security?
I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text.
What are the benefits of such a setup over a ...
0
votes
2answers
97 views
Cryptography in simple words anout one idea?
I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing ...
-1
votes
1answer
299 views
What does pseudonymization mean in the context of web development?
In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development.
The info I've read infers that it is ...
0
votes
1answer
101 views
Database logs have multiple “Logon Login failed for user” from different IPs
Background: I have an SQL Server database running on Amazon RDS
The AWS dashboard has a section for logs and whenever I check the logs I see the following:
2018-04-27 06:10:26.00 Logon Error: 18456,...
0
votes
0answers
32 views
Clarification on authentication tokens
This question is split into multiple questions which - at least over on SO - is frowned upon, but it boils down to one main question, which is: what's the correct way to use authentication tokens?
...
3
votes
1answer
409 views
Are MariaDB's encryption and compression functions secure?
MariaDB [(none)]> SET @key_str = SHA2('Is it secure?',512);
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> SET @crypt_str = AES_ENCRYPT('cleartext',@key_str);
Query OK, 0 rows affected (...
0
votes
0answers
28 views
Security of password to database in 2-layer SW model
I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly.
This of course mean that the ...
3
votes
1answer
2k views
Does it make sense to encrypt database to comply with GDPR?
I had a hard time phrasing the question. I'd rather ask, "How do I comply with GDPR?" But that would probably be too broad of a question. Database encryption concerns me the most, since that's what ...
3
votes
3answers
191 views
What is the benefit of the database's information_schema for a hacker?
What is the benefit of the database's information_schema for a hacker? I am talking about SQL injection exploitation.
