Questions tagged [postgresql]
PostgreSQL is an open-source RDBMS.
56 questions
4
votes
1
answer
1k
views
Is using `crypt` in PostgreSQL for password comparison secure against timing attacks?
I'm currently using PostgreSQL with the pgcrypto extension to store and verify user passwords. When a user logs in, I compare the entered password with the stored hash using the following query:
...
- 45
0
votes
1
answer
1k
views
How to do character escaping in PostgreSQL to prevent a SQL injection attack?
I want to prevent SQL injection attacks in a rather abstract application. Therefore I want to escape all user provided input as described here. The other options provided on this page don't fit in my ...
- 113
1
vote
2
answers
3k
views
AWS RDS Database access from Github Actions
I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS.
The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is ...
- 111
0
votes
0
answers
123
views
Using different public keys on the same (encrypted) column
Generally, when encrypting sensitive-data columns, we use the same public key for all the rows. I have noticed that it is possible to use different public keys for different rows. For example, ...
- 423
3
votes
2
answers
180
views
Any obvious pitfalls of modeling access control policies using subject, scope, object?
Context
A small web application with REST API and postgres as db, that has users, documents and teams. A user can do basic CRUD operations on document.
A user is always a part of a team. A team is ...
- 33
25
votes
6
answers
9k
views
Is a sha256 hash of a unix timestamp a strong password
I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
- 497
0
votes
0
answers
88
views
Is there much practical security value in using passwords/usernames for postgres instances used on development machines?
So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
- 101
1
vote
0
answers
2k
views
Bypass sql injection filtering (whitespace, /, *) [closed]
I want to bypass a sql injection waf that replaces /,* and whitespaces.
This is a payload I want use :
?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table--
But the ...
- 11
3
votes
1
answer
640
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,468
0
votes
1
answer
302
views
Postgres.app security on a Mac?
I'm wondering if there are any security concerns with installing PostgreSQL on a Mac using the app?
https://www.postgresql.org/download/macosx/
I had a look at the data folder and it's owned by me ...
- 33
2
votes
0
answers
212
views
Pros and Cons of hashing password on DB or on API server interacting with db [closed]
I'm trying to understand what is good/bad about hashing a password on a database (like postgres) as opposed to hashing it on an api server and then sending it hashed to the db. Can anyone speak on ...
- 21
0
votes
1
answer
384
views
Escaping out of a select query to run a statement that modifies data in the database
Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
- 101
0
votes
1
answer
3k
views
Postgres password hash crack
I installed the lastest version of PostgreSQL (13.2) to understand it better and I used the command SELECT usename, passwd from pg_shadow; to extract the hash with the default username postgres but I ...
- 27
0
votes
1
answer
138
views
How to use Gutmann method SQL?
Is it possible to use the Gutmannr method for a single SQL cell?
10
votes
1
answer
1k
views
Permanently delete a record
Say there is a SQL database that stores certain records in encrypted. A person wants deletion of a record in a way that even hard drive recovery services cannot recover it without breaking the hard ...
1
vote
1
answer
6k
views
Cannot perform SQL injection because of the weird postgresql syntax that is used
I have a website that uses ManageEngine Service Plus and it has a SQL injection vulnerability
the linksays that with the help of the following url we would be able to inject postgresql commands to get ...
- 21
0
votes
2
answers
649
views
Do I transmit a plaintext password to my PostgreSQL server?
PostgreSQL supports multiple authentication methods, and I think it supports SSL and plaintext connections. How do I find out which authentication method a server uses? I do not have access to the ...
- 34.4k
2
votes
0
answers
137
views
When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?
Suppose I have this:
parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']);
The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
- 21
5
votes
2
answers
572
views
If Postgres trusts localhost connections, is it dangerous to visit random websites?
If I have a locally running Postgres configured to trust all connections from localhost, does it mean any website I visit has the ability to make a localhost-to-localhost connection to Postgres with ...
- 449
1
vote
1
answer
1k
views
Why intruder number of threads has an effect on the time delay of indiviual requests
I was solving SQL injection lab on Portswigger, and the lab was asking to exploit blind SQL injection by triggering time delays, using that to retrieve administrator password.
I was making 720 ...
- 123
0
votes
1
answer
2k
views
PostgreSQL injection with basic sanitization
I'm trying to figure out if an SQLi for the following PostgreSQL/Java code exists.
public void availableItems(String name) {
return this.query("SELECT * FROM items WHERE name='"+name+"...
3
votes
1
answer
376
views
Can I skip any password hashing for localhost authentication?
Setup
I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system.
everyone is on the same host
they use the loopback interface (127.0.0.1) to ...
6
votes
1
answer
6k
views
Is it safe to set rejectUnauthorized to false when using Heroku's Postgres database?
I am trying to put some fields in a Postgres database hosted on a Heroku app and it keeps returning this error:
Error: self signed certificate
code: 'DEPTH_ZERO_SELF_SIGNED_CERT'
I have tried adding ...
- 63
3
votes
3
answers
439
views
Is SQL injection still a bad thing if the user is restricted to non-harmful queries?
Suppose I have a very simple PHP application that acts as a front-end for an SQL database. The user enters their query into a box, and the app shows the query results in a table.
To prevent a user ...
- 33
2
votes
2
answers
186
views
How can a restricted window for sql injections be abused?
I have a postgres 11 database with no confidential information in it and in the application an intruder can write queries inside the following update statement.
UPDATE table
SET col_a = val_b
WHERE {...
2
votes
2
answers
379
views
Allowing users to input raw SQL in update statement safely
I'm building an application and I have some very, very advanced users who can come up with endless filters they want. They know SQL so in the end gave them some of the filters and said in the bottom ...
4
votes
2
answers
1k
views
Separate Auth DB for Increased Security
I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
- 143
1
vote
1
answer
246
views
What kinds of attacks are possible with credentials to a read-only Postgres user?
Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple ...
- 153
4
votes
2
answers
7k
views
How secure is pgAdmin to save database password?
When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the ...
- 301
4
votes
1
answer
4k
views
Thousands of 28000 "no pg_hba.conf entry for host" logs from Postgres - is this an attack?
Since yesterday afternoon my production Postgres database hosted on Amazon EC2 has been logging thousands of errors (averaging one or two per second) that all follow the format:
sql_error_code = ...
- 143
2
votes
1
answer
1k
views
SQL injection on PostgreSQL in integer field?
I was trying https://server/shared/sendemail?sendto=" and got this response:
Database operation "0or1row" failed
(exception ERROR, "ERROR: invalid input syntax for integer:"""
LINE 4: where user_id ...
- 23
1
vote
0
answers
156
views
HIPAA compliant BI reporting tool?
We are building an application for healthcare industry and we are planning to use a 3rd party BI tool for reporting which will directly connect to our postgres DB and generate the desired reports ...
- 111
1
vote
0
answers
151
views
I had a (password protected) postgres docker container running on a public port for a few minutes [closed]
Could the server be compromised? I've deleted the container.
- 11
2
votes
1
answer
414
views
How to understand how someone had ssh access, and how to remove CVE-2017-0358
I have a home server that was compromised recently, it has been used to mine some crypto currencies.
I have not stopped anything yet apart from locking ssh to my user only. The processes are still ...
- 123
2
votes
3
answers
1k
views
How strong should a database password be?
Seems like a trivial question, but I couldn't find other questions that address the following.
So I'm simply asking, how strong would my (super user) database credentials ideally be? I simply figured ...
- 393
1
vote
1
answer
740
views
Public guest user for PostgreSQL?
I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest ...
- 113
71
votes
3
answers
14k
views
Is this a SQL injection attack or is it some sort of bug?
I was looking through some data in our database when I came across a bunch of weird user_id entries:
user_id
-1080) ORDER BY 1#
-1149 UNION ALL SELECT 79,79,79,79,79,79,79,79,79#
-1359' UNION ALL ...
- 805
2
votes
1
answer
612
views
Is sharing databases's hostname considered to be a security hole?
We have a Postgres database running on a Heroku and want to setup an external connection to it from the DB management GUI application (e.g. pgAdmin)
Being novice to security things I wonder if it is ...
- 23
6
votes
2
answers
8k
views
Postgres protection from SQL Injection
Postgres allows dynamic code execution, which might leave it vulnerable to SQL injection.
What protective measures does it have against this?
- 245
8
votes
2
answers
4k
views
Postgres password security
How safe is a Postgres user's password?
When a new db user is created, is the stored password hashed and salted?
- 245
-3
votes
2
answers
3k
views
What logs to look for on Ubuntu when Postgres DB is hacked! [closed]
Updated the question title to clarify that this post is not asking the community to answer "how we got hacked" but "what logs to look for or pointers that may help our investigation". We feel that ...
2
votes
1
answer
1k
views
Heroku postgres: potential brute force attack
I have a Django app running on Heroku using Heroku Postgres.
I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database ...
- 485
0
votes
1
answer
237
views
Allowing customer to generate a secret key for securing RDS instance on AWS
I have an microservice architecture running on AWS ECS cluster using Postgres and Node and there is this requirement that we need to somehow allow our client to lock our database with a secret key ...
- 101
3
votes
1
answer
363
views
Ciphertext vs database level encryption
For data that must be encrypted (read again, not hashed like a password) does storing ciphertext in a database gain you much over using the database's built-in encryption?
In this case it would be ...
- 133
1
vote
1
answer
1k
views
How many combinations of md5sums can be computed from a call to random() in PostgreSQL?
Problem space
I'm way out of my pay grade, I'm trying to figure out
How much randomness does a call to random() actually provide in PostgreSQL?
SELECT random();
Whether or not you can reasonably ...
- 3,107
1
vote
3
answers
8k
views
Metasploit Search Multiple Keywords
I am having an issue with Metasploit's search commands. When trying to search multiple keywords, the output displays only the first keyword. For example, if I use the command search platform:windows ...
- 1,300
4
votes
1
answer
361
views
Restoring database from a hacked system
A linux VM with postgres 9.4 was hacked into. (Two processes taking 100% cpu, weird files in /tmp, did not reoccur after kill(s) and restart.) It was decided to install the system from scratch on a ...
- 155
1
vote
2
answers
1k
views
Is it bad to give www-data user access to Postgres client certificate?
I have a first server running a Postgres database.
I have allowed remote access to this database, using certificates for authentification (following this tutorial).
Now I have a second server running ...
- 113
2
votes
4
answers
5k
views
Can TLS be a secure alternative to VPN?
I am developing an application that will be run by untrusted users in high performance computing centers. My users will not have root access, therefore VPN is not an option.
I need some way to ...
- 125
0
votes
2
answers
430
views
Is there a way to specify PHP escape method when using SQLmap?
I'm helping a collegue of mine to test if his website is completely SQLi-proof. It looks promising, but i'm trying to make sure, and by chance I know he's using pg_escape_string to sanitize his POST ...
- 101