Questions tagged [databases]
Security related aspects of databases and database access.
0
votes
2answers
43 views
Does choice of DBMS matters in the protection of XSS and other injection attacks
I have filtered into 3 most used databases, MySQL, Microsoft SQL server and mangoDB. I have to choose the most secure database from these three.
Does my choice of DBMS has a role in protection ...
1
vote
0answers
73 views
How to crack encrypted Android SQLite DB?
I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts,
How do we ensure that DB is encrypted properly and it is ...
133
votes
3answers
13k views
Is HostGator storing my password in plaintext?
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
2
votes
1answer
104 views
How safe is it to open source access to MySQL database on github, only permitting SELECT query?
The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
2
votes
3answers
133 views
Are there examples of implementing security as a side effect?
I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
1answer
45 views
Which is more secure: saving reference link to file in file system in the database, or save the entire file into the database?
We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of ...
1
vote
2answers
75 views
Is it legal to store users searches [closed]
Im developing a webshop and i got a task asking for storing users searches. Is it legal?
It will be stored in a db with the fields Date, Search text, userId
1
vote
1answer
48 views
Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?
Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program.
There's a problem with this, and that's that it ends up in ...
1
vote
2answers
155 views
How to obfuscate a relation between two tables in a database?
I have a kind of weird use case here, and I'm not sure how to deal with it.
I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't ...
0
votes
1answer
38 views
Storing files in database through encryption and Viewing them only on providing key for the file
I have this use case:
User1 uploads his file into the database which should be encrypted.
Any other users who request that file, user1 will be notified for approval, on approving other users should ...
0
votes
1answer
40 views
What would be the best way to evaulate the database management systems? [closed]
I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
107 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
2
votes
2answers
367 views
Is it worth storing email addresses as hashes?
If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes.
Is it worth storing email ...
0
votes
0answers
58 views
Introduce a SQLi in a testing application
So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
447 views
Is forbiding the ; char enough to prevent SQL injection?
Disclaimer: Parameterized queries are the way to go, no need to discuss about that :)
I've seen the following code at a friends place:
var query = "SELECT * FROM students WHERE name = " + name;
...
0
votes
1answer
59 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
0
votes
1answer
27 views
Prevent Database from accessing with knowing system admin user [closed]
My question might be broad. Suppose that we trying to store our client's information data with a database on a server. The server may get a vulnerability and give access to a hacker to get access to ...
3
votes
2answers
94 views
Store database access password in PHP class const?
I have PHP project and I need to store MySQL access information.
I have a config.php file outside public directory and in the file I have:
class Config
{
const host = "dbserver";
const name =...
1
vote
0answers
37 views
Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?
LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider.
Any input would be swell!
-
A case ...
1
vote
0answers
28 views
How should I secure my database in Microservice architecture
Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
1answer
52 views
hiding emails in database [closed]
I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
15
votes
5answers
430 views
Business founder wants access to database but has no DB skills
Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
1
vote
0answers
32 views
Web application secrets protection following code execution
I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
0answers
22 views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
1answer
86 views
IP-whitelisting for DB access, does solution fit best practices?
All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
1
vote
1answer
572 views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
3
votes
1answer
62 views
Security consequences of a publicly accessible database?
I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
0
votes
1answer
44 views
How to securely load data to a database in vendor server such that vendor does not see raw data at all?
Scenario: client will be uploading files with sensitive information to a vendor server for loading into a database. Due to the confidential nature of the files, the client does not want any archiving ...
0
votes
0answers
94 views
How to find accounts in leaked databases based on the domain name in the email address?
I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
-1
votes
1answer
104 views
Local File Download(LFD) vulnerability exploit
I have found a arbitrary file download vulnerability in an asp.net application.
I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
1
vote
2answers
550 views
Database Pentest methodology or list? [closed]
I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
1answer
27 views
What are design and security considerations for a site that connects to its users' own dbs?
I'm envisaging a website where a user signs up, has their own database running somewhere, then provides credentials to the website so that website can access that database. For example, if I was the ...
1
vote
2answers
65 views
Storing customer data securely (compliance)
I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do.
...
2
votes
2answers
86 views
Should I implement access control on databases inside a trusted network?
Excerpt from Redis' security article:
Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance ...
0
votes
1answer
86 views
Is it possible to get data from database server if you are on the application server?
For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
1
vote
1answer
157 views
Can you tell me if my design is secure?
I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows.
I'm running three ...
6
votes
2answers
567 views
How dangerous is disclosing a table's structure to users?
I apologize if this is a dumb question.
I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
2answers
118 views
Restricting source code exposure
Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them.
Also, say you want to keep certain files inaccessible to people ...
1
vote
2answers
86 views
How helpful is encrypting/decrypting information on an app-server, and sending it to the database encrypted?
I just added some code to our app server to encrypt personal information before it's stored in the database. This was mostly done for compliance reasons, but how much of an actual security win is it?
...
-1
votes
1answer
196 views
Attempting SQLi against website with WAF filter [closed]
I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
1
vote
2answers
966 views
Bcrypt data type and length?
I'm using the following library for hashing my password.
string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow");
The length is apparently 60 each time. My question is, I'm planning to ...
8
votes
5answers
833 views
Should I authenticate user on every request?
I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or ...
-1
votes
1answer
109 views
How to securely generate and store the salting for password hash? [duplicate]
Assume a client authenticates using the password, which includes hashing and salting. The hash values are stored in a remote database server.
Questions:
For the hash values stored in the database ...
1
vote
1answer
280 views
dangers of using WAMPServer on my home PC?
Hello there I have been working on (learning) web development and have gone down the route of self hosting at the moment. I have a website which I've made, it doesnt have any user interface for input, ...
2
votes
3answers
175 views
Partitioning database to enhance security/anonymity?
The goal here is to prevent identification of the users and their data. Is it a good idea to partition my database into multiple ones, one for each kind of sensitive data, hiding the links between ...
6
votes
1answer
742 views
Retreiving Google Chrome passwords
While retrieving Google Chrome passwords on macOS, I've noticed that the passwords all come up as the same thing (something along the lines of): Vi??M!4NNn. How I retreived them was with the following ...
0
votes
1answer
82 views
Tokenization - Is it bad practice to reuse tokens?
If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens?
For example, if I am storing the name "Richard" multiple times, and ...
40
votes
8answers
8k views
Does password-protecting a database living next to the application add any security?
I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text.
What are the benefits of such a setup over a ...
0
votes
2answers
99 views
Cryptography in simple words anout one idea?
I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing ...
-1
votes
1answer
315 views
What does pseudonymization mean in the context of web development?
In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development.
The info I've read infers that it is ...
