Questions tagged [databases]
Security related aspects of databases and database access.
1
vote
0answers
20 views
How to anonymise a numeric data attribute, whilst preserving indexability?
I would like to (1-way) anonymise some bounded, numeric data attributes (e.g. age, optimistically bounded by 0 and 200), whilst still retaining the ability to use the resulting data in an index for ...
1
vote
2answers
107 views
Is VirusTotal useful for finding malware in a WordPress database SQL export?
Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
0
votes
0answers
28 views
Development and Production on the same RDS instance, but under different databases?
I was told to create a single RDS instance (amazon web services RDS) onto which I should create two users, development and production, and two databases, development and production. The idea is that ...
0
votes
1answer
61 views
Do HIPAA compliant web server and database need to be on the same server? [on hold]
I work for a small IT firm and we are creating a web application (MVP) for doctors (in the USA).
The patients will register with the application. We will only save their name, email, password (hashed)...
0
votes
0answers
39 views
Foreign key constraint danger - information leakage?
Suppose we have an SQL database.
Suppose we have a user D who has no read access to some table named EMP (employees).
Suppose we allow him to create a table with a foreign key regarding EMP table. Is ...
1
vote
3answers
101 views
Which function to hash 128 bit API key with?
I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
0
votes
1answer
43 views
Do I need to use salt with api key hashing?
I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password?
AFAIK salt prevents rainbow table attack and those are more ...
12
votes
3answers
3k views
Would encrypting a database protect against a compromised admin account?
I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
0
votes
2answers
56 views
Does choice of DBMS matters in the protection of XSS and other injection attacks
I have filtered into 3 most used databases, MySQL, Microsoft SQL server and mangoDB. I have to choose the most secure database from these three.
Does my choice of DBMS has a role in protection ...
1
vote
0answers
150 views
How to crack encrypted Android SQLite DB? [closed]
I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts,
How do we ensure that DB is encrypted properly and it is ...
133
votes
3answers
14k views
Is HostGator storing my password in plaintext?
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
2
votes
1answer
110 views
How safe is it to open source access to MySQL database on github, only permitting SELECT query?
The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
2
votes
3answers
141 views
Are there examples of implementing security as a side effect?
I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
1answer
49 views
Which is more secure: saving reference link to file in file system in the database, or save the entire file into the database?
We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of ...
1
vote
2answers
82 views
Is it legal to store users searches [closed]
Im developing a webshop and i got a task asking for storing users searches. Is it legal?
It will be stored in a db with the fields Date, Search text, userId
1
vote
1answer
51 views
Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?
Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program.
There's a problem with this, and that's that it ends up in ...
1
vote
2answers
161 views
How to obfuscate a relation between two tables in a database?
I have a kind of weird use case here, and I'm not sure how to deal with it.
I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't ...
0
votes
1answer
38 views
Storing files in database through encryption and Viewing them only on providing key for the file
I have this use case:
User1 uploads his file into the database which should be encrypted.
Any other users who request that file, user1 will be notified for approval, on approving other users should ...
0
votes
1answer
40 views
What would be the best way to evaulate the database management systems? [closed]
I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
194 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
2
votes
2answers
430 views
Is it worth storing email addresses as hashes?
If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes.
Is it worth storing email ...
0
votes
0answers
60 views
Introduce a SQLi in a testing application
So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
449 views
Is forbiding the ; char enough to prevent SQL injection?
Disclaimer: Parameterized queries are the way to go, no need to discuss about that :)
I've seen the following code at a friends place:
var query = "SELECT * FROM students WHERE name = " + name;
...
0
votes
1answer
61 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
0
votes
1answer
31 views
Prevent Database from accessing with knowing system admin user [closed]
My question might be broad. Suppose that we trying to store our client's information data with a database on a server. The server may get a vulnerability and give access to a hacker to get access to ...
3
votes
2answers
100 views
Store database access password in PHP class const?
I have PHP project and I need to store MySQL access information.
I have a config.php file outside public directory and in the file I have:
class Config
{
const host = "dbserver";
const name =...
1
vote
0answers
41 views
Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?
LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider.
Any input would be swell!
-
A case ...
1
vote
0answers
32 views
How should I secure my database in Microservice architecture
Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
1answer
53 views
hiding emails in database [closed]
I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
15
votes
5answers
432 views
Business founder wants access to database but has no DB skills
Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
1
vote
0answers
32 views
Web application secrets protection following code execution
I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
0answers
22 views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
1answer
106 views
IP-whitelisting for DB access, does solution fit best practices?
All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
1
vote
1answer
612 views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
3
votes
1answer
73 views
Security consequences of a publicly accessible database?
I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
0
votes
1answer
45 views
How to securely load data to a database in vendor server such that vendor does not see raw data at all?
Scenario: client will be uploading files with sensitive information to a vendor server for loading into a database. Due to the confidential nature of the files, the client does not want any archiving ...
0
votes
0answers
122 views
How to find accounts in leaked databases based on the domain name?
I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
-1
votes
1answer
130 views
Local File Download(LFD) vulnerability exploit
I have found a arbitrary file download vulnerability in an asp.net application.
I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
1
vote
2answers
795 views
Database Pentest methodology or list? [closed]
I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
1answer
27 views
What are design and security considerations for a site that connects to its users' own dbs?
I'm envisaging a website where a user signs up, has their own database running somewhere, then provides credentials to the website so that website can access that database. For example, if I was the ...
1
vote
2answers
72 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
2
votes
2answers
87 views
Should I implement access control on databases inside a trusted network?
Excerpt from Redis' security article:
Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance ...
0
votes
1answer
92 views
Is it possible to get data from database server if you are on the application server?
For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
1
vote
1answer
157 views
Can you tell me if my design is secure?
I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows.
I'm running three ...
6
votes
2answers
571 views
How dangerous is disclosing a table's structure to users?
I apologize if this is a dumb question.
I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
2answers
120 views
Restricting source code exposure
Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them.
Also, say you want to keep certain files inaccessible to people ...
1
vote
2answers
86 views
How helpful is encrypting/decrypting information on an app-server, and sending it to the database encrypted?
I just added some code to our app server to encrypt personal information before it's stored in the database. This was mostly done for compliance reasons, but how much of an actual security win is it?
...
-1
votes
1answer
207 views
Attempting SQLi against website with WAF filter [closed]
I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
1
vote
2answers
1k views
Bcrypt data type and length?
I'm using the following library for hashing my password.
string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow");
The length is apparently 60 each time. My question is, I'm planning to ...
8
votes
5answers
924 views
Should I authenticate user on every request?
I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or ...
