Skip to main content

Questions tagged [databases]

Security related aspects of databases and database access.

Filter by
Sorted by
Tagged with
2 votes
1 answer
1k views

Offline, multi-machine, 2-factor authentication information vault?

I think this should be the right SE, apologies otherwise I have been researching ways to be more careful with how I handle important documents and credentials, but everything I found sounded ...
Mister Mystère's user avatar
1 vote
1 answer
81 views

Storing TOTP keys

I am working on a application which requires session token to commence trading activities. This will be hosted on a cloud based Linux VM (Ubuntu) and a managed MySQL database. Session token are ...
excelman's user avatar
  • 111
0 votes
0 answers
104 views

Accidently used --flush-session --batch in sqlmap tool. Need help!

I was working on a target where sqlmap detected boolean based time blind injection. Everything was working perfect but you know it was time blind injection so I knew that this is going to take forever ...
Solo's user avatar
  • 41
0 votes
1 answer
80 views

Why is the boot key used to access the encrypted SAM database hashes?

A quick something I’ve been wondering: why is the boot key used to access the encrypted SAM database hashes, (and not another key,) and also what encryption mechanism is actually used to encrypt the ...
security_paranoid's user avatar
0 votes
2 answers
134 views

How do databases/companies change their hashing algorithm? [duplicate]

Ok- so you all probably know that a hash is used to help secure a stored password in a database, if it was stolen. When a user logs in, and enters a password, it gets hashed, and then matched to a ...
security_paranoid's user avatar
1 vote
1 answer
141 views

Library to securely expose query language to end user?

I have a DB that I would like to expose to end users for flexible search through their data. Currently using Elastic, but not tied to that: I can internally transform the data in any way to enable ...
curious-bunny1's user avatar
0 votes
1 answer
138 views

OAuth2: Storing temp values in session vs database

I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
Ryan's user avatar
  • 101
1 vote
2 answers
215 views

Is it safe to store database credentials as plain text in the configuration file?

Some services like ejabberd, nginx for authenticating using a database, and dovecot requires providing the database password as plain text in the configuration file. Is it safe to store MariaDB ...
whiteman808's user avatar
0 votes
0 answers
95 views

Risk for a public RDS database on AWS

I have a RDS database on a VPC which is public with a password. I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
JVanced's user avatar
1 vote
1 answer
109 views

How to ensure privacy of my codebase while keeping data on client premises?

I have created a data science model pipeline in Python which ingests some data (user transactions) and then runs some models to generate a report. The models that I have created are proprietary and so ...
finstats's user avatar
  • 111
1 vote
2 answers
104 views

Is it safe to keep a JDBC SQLite URI in source code?

If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI? Should I replace the name of the SQLite db with code to ...
Setu Kumar Basak's user avatar
0 votes
0 answers
90 views

How much does manually entering a key at process start help?

I have an application that encodes data when writing it to a database, and unencodes it when reading from the database. The encoding is done with a symmetric algorithm using a fixed secret key. I'm ...
M Katz's user avatar
  • 215
0 votes
2 answers
511 views

How much security do DigitalOcean managed databases provide?

DigitalOcean offers managed databases. From what I can understand, the advantages are: You don't have to worry about management tasks such as set-up, updates (including security updates), and backups....
M Katz's user avatar
  • 215
0 votes
0 answers
76 views

Why do most DP mechanisms consider constant noise variance across data points?

I have been studying Differential Privacy (DP) and there’s something I do not understand: why is the variance of the noise in most DP schemes constant across all individuals (assuming a one-to-one ...
synack's user avatar
  • 101
0 votes
2 answers
190 views

Post Exploitation in Oracle web logic server 10.35 (Oracle Linux Server 3.8)

Web Server : Oracle WebLogic 10.35 Machine : Oracle Linux Server 3.8 I was able to partially exploit this CVE. I can execute any command on server using HTTP request and redirecting its output to a ...
Abu Bakar's user avatar
2 votes
1 answer
298 views

What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)

There are functions like MD5 and SHA2 in MySQL which can be used to hash values before putting them into the database, or when searching over values. As I proposed a possible solution in a comment to ...
v_slav.b's user avatar
1 vote
1 answer
666 views

What's the difference between dynamic and static parameters in Sqlmap?

What are the practical differences between them? i.e. a parameter referred to as being "dynamic" and "not dynamic"?
fdku's user avatar
  • 11
1 vote
1 answer
161 views

Do web-hosting sites like Heroku or Railway expose your database?

I was watching this video https://www.youtube.com/watch?v=Qm7k1CPFkIc about how to steal passwords and the guy mentioned that you can use shodan.io (a site that lists various devices connected to the ...
Some Guy's user avatar
  • 115
0 votes
1 answer
150 views

Are there any downsides to publically available encrypted data?

I have a key-value database that uses asymmetric RSA-OAEP encryption to encrypt the data. The data is stored in tuples of (public key, encrypted data). The user identifies their data by the public key,...
willuhmjs's user avatar
1 vote
1 answer
155 views

Encrypted user data and storing hashed RSA keys on the server for backup reasons

Imagine a mobile app that connects to an API server. Disclaimer I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives. The goal The backend/database super ...
Laisender's user avatar
  • 111
1 vote
2 answers
2k views

AWS RDS Database access from Github Actions

I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS. The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
Jöcker's user avatar
  • 111
2 votes
0 answers
2k views

How Secure Is It to Use SQLite for Identity Storage in a Web App

I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my ...
Emre Bener's user avatar
2 votes
1 answer
153 views

How to make sure that your backups are not encrypted?

Say a ransomware encrypts your database but hides the fact (by secretly decrypting everything you ask for). Then your backups become rubbish once the attacker deletes the key. What are good measures ...
J Fabian Meier's user avatar
1 vote
1 answer
1k views

What are these http requests trying to break?

I recently started receiving some really strange http traffic, and I'd like to understand what it's trying to do. Some of it seems like sql injection attempts, but the strings are appearing in the ...
ConfusedHost's user avatar
1 vote
2 answers
720 views

Malware prevention of data received in a POST endpoint

Problem Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental? To consider (please read) POST data receives ...
Federico Baù's user avatar
3 votes
1 answer
396 views

How to design a desktop application that has access to a database via LAN?

As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
SERO9's user avatar
  • 31
7 votes
2 answers
5k views

Should user credentials and user info be stored in seperate tables?

Should I store credentials (like email, hashed password) in a separate table than the user's profile information (bio, gender, etc)? My main concern is that I'll be sending other user's information (...
user avatar
1 vote
2 answers
492 views

Using one server and user database for multiple websites

Goal I'd like to have multiple independent websites with one shared authentication server. The auth server will have one database in which all users are stored (just username, email and password, so ...
Mike V.'s user avatar
  • 11
1 vote
1 answer
118 views

Is there a security benefit to keeping data in separate tables?

Sorry if this is naïve , but the recent data leaks in Australia have me wondering. Question have been asked of Optus in particular (a local Telco) whether they really should have hung on to identity ...
Manngo's user avatar
  • 141
1 vote
1 answer
151 views

Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?

For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
galadriel34's user avatar
2 votes
1 answer
681 views

Is encryption with MySQL Aes_encrypt() + stored procedure ok?

I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database. Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
Poubelle Dirty's user avatar
1 vote
0 answers
321 views

MySQL encrypt fields and decrypt them with a password

I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password. So let's say I've got user X that stores something ...
Yamile's user avatar
  • 11
1 vote
2 answers
131 views

How can an attacker cryptolock a database content after having compromised the application server, which protection to setup?

I have an application server accessible from the Web, behind a reverse proxy. Its database is secured on a separate VLAN and the database admin password is strong. Say the application or the operating ...
lalebarde's user avatar
  • 617
3 votes
3 answers
685 views

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

Let's say we have: Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
Alexander's user avatar
1 vote
2 answers
263 views

Ports open on jump server in CDE

We placed a jump server in CDE to restrict the direct access to PCI in-scope devices (although I believe it should be outside CDE, please confirm) Now, we have opened SQL ports 1433 and application ...
user30026's user avatar
0 votes
1 answer
168 views

Site "can't" change username, why? [closed]

There's a website I have an account on, and I needed to change my username. They said they were unable to change that. I requested to just have my account deleted, and then I would create a new ...
Thomas's user avatar
  • 1
1 vote
1 answer
206 views

The server acts as a database server , but there is no open port regarding that why?

I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities. The server does multiple functionalities, It acts as a web ...
Kumar's user avatar
  • 41
25 votes
6 answers
9k views

Is a sha256 hash of a unix timestamp a strong password

I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
ThisGuyCantEven's user avatar
2 votes
1 answer
591 views

Best practice to encrypt data on smartphone

What is best practice for the encryption of offline application data? I have an application where multiple users can log in. The user gets data from an internet API, where the user authenticates. I ...
Donatic's user avatar
  • 121
1 vote
2 answers
105 views

Trustless Application Architecture for end-users with secure enclaves

I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
vin42tau's user avatar
0 votes
2 answers
186 views

What are best practices for finding an account in a SQL database during authentication? Is using `LIMIT 1` vulnerable to timing attacks?

I have a application where users can log in by providing a username or email address (both case insensitive) and a password. In the users table in the database, the relevant account information is ...
limitone's user avatar
0 votes
0 answers
76 views

Is there much practical security value in using passwords/usernames for postgres instances used on development machines?

So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
Jack Kinsella's user avatar
23 votes
12 answers
8k views

Storing weakness level of passwords

I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
BinarSkugga's user avatar
3 votes
0 answers
2k views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
Waristea's user avatar
2 votes
3 answers
194 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
12345's user avatar
  • 23
3 votes
1 answer
553 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
watchowl's user avatar
  • 5,458
2 votes
0 answers
197 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
Struggler's user avatar
2 votes
2 answers
704 views

Multiple user sessions at the same time in a backoffice [closed]

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
0 votes
2 answers
134 views

Is it possible to compromise a device by connecting to a database?

I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL) I'm wondering if it's possible that my secure device ...
Trevor's user avatar
  • 533
1 vote
0 answers
240 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
NicholaiRen's user avatar

1
2 3 4 5
16