All Questions
758 questions
4
votes
1
answer
437
views
putting database mongod.conf under $HOME/web-server/. instead of /etc/
Would there be any security concerns saving mongod.conf to $HOME/web-server/mongod.conf instead of /etc/mongod.conf ?
If the config was under $HOME/web-server/mongod.conf would that mean someone (or a ...
- 201
0
votes
1
answer
53
views
How can I securely store a sensitive user attribute used for account lookup?
At $work we need to store a sensitive attribute of a user (say SSN - so, short and with a small keyspace) and look up the user based on this attribute when data is submitted into our system. We cannot ...
- 739
0
votes
0
answers
223
views
MariaDB SQL Injection
I'm doing a website PT lab and I'm trying to figure out SQL vulnerability in MariaDB.
After some scanning I found the /api/ path, and one of them gives the desired SQL
I found out that ' gives me the ...
- 1
2
votes
1
answer
1k
views
Offline, multi-machine, 2-factor authentication information vault?
I think this should be the right SE, apologies otherwise
I have been researching ways to be more careful with how I handle important documents and credentials, but everything I found sounded ...
- 215
1
vote
1
answer
226
views
Storing TOTP keys
I am working on a application which requires session token to commence trading activities. This will be hosted on a cloud based Linux VM (Ubuntu) and a managed MySQL database.
Session token are ...
- 111
0
votes
0
answers
219
views
Accidently used --flush-session --batch in sqlmap tool. Need help!
I was working on a target where sqlmap detected boolean based time blind injection. Everything was working perfect but you know it was time blind injection so I knew that this is going to take forever ...
- 41
0
votes
1
answer
123
views
Why is the boot key used to access the encrypted SAM database hashes?
A quick something I’ve been wondering: why is the boot key used to access the encrypted SAM database hashes, (and not another key,) and also what encryption mechanism is actually used to encrypt the ...
- 3,035
0
votes
2
answers
233
views
How do databases/companies change their hashing algorithm? [duplicate]
Ok- so you all probably know that a hash is used to help secure a stored password in a database, if it was stolen.
When a user logs in, and enters a password, it gets hashed, and then matched to a ...
- 3,035
1
vote
1
answer
164
views
Library to securely expose query language to end user?
I have a DB that I would like to expose to end users for flexible search through their data. Currently using Elastic, but not tied to that: I can internally transform the data in any way to enable ...
0
votes
1
answer
304
views
OAuth2: Storing temp values in session vs database
I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
- 101
1
vote
2
answers
253
views
Is it safe to store database credentials as plain text in the configuration file?
Some services like ejabberd, nginx for authenticating using a database, and dovecot requires providing the database password as plain text in the configuration file. Is it safe to store MariaDB ...
- 131
0
votes
0
answers
117
views
Risk for a public RDS database on AWS
I have a RDS database on a VPC which is public with a password.
I have some lambda functions (that are not in a VPC) that communicates with this database. To be able to do that I had to modify the ...
- 1
1
vote
1
answer
115
views
How to ensure privacy of my codebase while keeping data on client premises?
I have created a data science model pipeline in Python which ingests some data (user transactions) and then runs some models to generate a report. The models that I have created are proprietary and so ...
- 111
1
vote
2
answers
112
views
Is it safe to keep a JDBC SQLite URI in source code?
If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI?
Should I replace the name of the SQLite db with code to ...
- 111
1
vote
2
answers
895
views
How much security do DigitalOcean managed databases provide?
DigitalOcean offers managed databases. From what I can understand, the advantages are:
You don't have to worry about management tasks such as set-up, updates (including security updates), and backups....
- 225
0
votes
2
answers
230
views
Post Exploitation in Oracle web logic server 10.35 (Oracle Linux Server 3.8)
Web Server : Oracle WebLogic 10.35
Machine : Oracle Linux Server 3.8
I was able to partially exploit this CVE. I can execute any command on server using HTTP request and redirecting its output to a ...
- 15
2
votes
1
answer
302
views
What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)
There are functions like MD5 and SHA2 in MySQL which can be used to hash values before putting them into the database, or when searching over values.
As I proposed a possible solution in a comment to ...
- 65
2
votes
1
answer
825
views
What's the difference between dynamic and static parameters in Sqlmap?
What are the practical differences between them? i.e. a parameter referred to as being "dynamic" and "not dynamic"?
- 21
1
vote
1
answer
192
views
Do web-hosting sites like Heroku or Railway expose your database?
I was watching this video https://www.youtube.com/watch?v=Qm7k1CPFkIc about how to steal passwords and the guy mentioned that you can use shodan.io (a site that lists various devices connected to the ...
- 115
0
votes
1
answer
154
views
Are there any downsides to publically available encrypted data?
I have a key-value database that uses asymmetric RSA-OAEP encryption to encrypt the data. The data is stored in tuples of (public key, encrypted data). The user identifies their data by the public key,...
1
vote
1
answer
169
views
Encrypted user data and storing hashed RSA keys on the server for backup reasons
Imagine a mobile app that connects to an API server.
Disclaimer
I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives.
The goal
The backend/database super ...
- 111
1
vote
2
answers
3k
views
AWS RDS Database access from Github Actions
I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS.
The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
- 111
2
votes
0
answers
2k
views
How Secure Is It to Use SQLite for Identity Storage in a Web App
I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my ...
- 121
2
votes
1
answer
157
views
How to make sure that your backups are not encrypted?
Say a ransomware encrypts your database but hides the fact (by secretly decrypting everything you ask for). Then your backups become rubbish once the attacker deletes the key.
What are good measures ...
- 123
1
vote
1
answer
2k
views
What are these http requests trying to break?
I recently started receiving some really strange http traffic, and I'd like to understand what it's trying to do. Some of it seems like sql injection attempts, but the strings are appearing in the ...
1
vote
2
answers
804
views
Malware prevention of data received in a POST endpoint
Problem
Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental?
To consider (please read)
POST data receives ...
- 65
3
votes
1
answer
491
views
How to design a desktop application that has access to a database via LAN?
As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
- 31
8
votes
2
answers
6k
views
Should user credentials and user info be stored in seperate tables?
Should I store credentials (like email, hashed password) in a separate table than the user's profile information (bio, gender, etc)?
My main concern is that I'll be sending other user's information (...
Brandon-Perry
1
vote
2
answers
575
views
Using one server and user database for multiple websites
Goal
I'd like to have multiple independent websites with one shared authentication server. The auth server will have one database in which all users are stored (just username, email and password, so ...
- 11
1
vote
1
answer
174
views
Is there a security benefit to keeping data in separate tables?
Sorry if this is naïve , but the recent data leaks in Australia have me wondering.
Question have been asked of Optus in particular (a local Telco) whether they really should have hung on to identity ...
- 141
1
vote
1
answer
158
views
Are there any benefits of encrypting columns with sensitive data in the AWS RDS that is encrypted at rest?
For example, I have an application that allows users to integrate with 3rd party apps. It stores API keys for those applications in AWS RDS as plain text(a pretty old functionality). From the security ...
- 11
2
votes
1
answer
766
views
Is encryption with MySQL Aes_encrypt() + stored procedure ok?
I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database.
Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
1
vote
0
answers
325
views
MySQL encrypt fields and decrypt them with a password
I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password.
So let's say I've got user X that stores something ...
- 11
1
vote
2
answers
140
views
How can an attacker cryptolock a database content after having compromised the application server, which protection to setup?
I have an application server accessible from the Web, behind a reverse proxy. Its database is secured on a separate VLAN and the database admin password is strong.
Say the application or the operating ...
- 617
3
votes
3
answers
800
views
Is it a good idea to reuse certificate issued by public CA for internal database client authentication?
Let's say we have:
Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
- 31
1
vote
2
answers
298
views
Ports open on jump server in CDE
We placed a jump server in CDE to restrict the direct access to PCI in-scope devices (although I believe it should be outside CDE, please confirm)
Now, we have opened SQL ports 1433 and application ...
- 11
0
votes
1
answer
176
views
Site "can't" change username, why? [closed]
There's a website I have an account on, and I needed to change my username. They said they were unable to change that. I requested to just have my account deleted, and then I would create a new ...
- 1
1
vote
1
answer
228
views
The server acts as a database server , but there is no open port regarding that why?
I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities.
The server does multiple functionalities, It acts as a web ...
- 41
25
votes
6
answers
9k
views
Is a sha256 hash of a unix timestamp a strong password
I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
- 497
2
votes
1
answer
612
views
Best practice to encrypt data on smartphone
What is best practice for the encryption of offline application data?
I have an application where multiple users can log in. The user gets data from an internet API, where the user authenticates. I ...
- 121
1
vote
2
answers
109
views
Trustless Application Architecture for end-users with secure enclaves
I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold ...
- 11
0
votes
2
answers
233
views
What are best practices for finding an account in a SQL database during authentication? Is using `LIMIT 1` vulnerable to timing attacks?
I have a application where users can log in by providing a username or email address (both case insensitive) and a password. In the users table in the database, the relevant account information is ...
- 3
0
votes
0
answers
88
views
Is there much practical security value in using passwords/usernames for postgres instances used on development machines?
So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
- 101
23
votes
12
answers
8k
views
Storing weakness level of passwords
I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
- 341
3
votes
0
answers
2k
views
How to Securely Store Database Password in Java .properties File
I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password.
I ...
- 41
2
votes
3
answers
196
views
Manage passwords from my personal website
So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
- 23
3
votes
1
answer
641
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,468
2
votes
0
answers
203
views
Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]
I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password.
The ...
- 21
2
votes
2
answers
834
views
Multiple user sessions at the same time in a backoffice [closed]
I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management.
The practice already has a backoffice-style software, but it's ...
user271185
0
votes
2
answers
150
views
Is it possible to compromise a device by connecting to a database?
I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL)
I'm wondering if it's possible that my secure device ...
- 533