Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sql-server]

SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

0
votes
1answer
45 views

SqlDateTime overflow.. Will this cause any issues ? is any kind of hacking or bypassing age restriction is possible in this case? [on hold]

We have a website with age restriction. If a user want to register in our website, user must be 18 years old.As i know there is validation at client and server side ? When i tried to register in our ...
1
vote
0answers
38 views

Is SQL Server capable of sending certificate chain to the client? [migrated]

I wonder if SQL Server is capable of sending certificate chain to the client, I tried every option while creating certificates and I am aware of what restrictions SQL Server puts on a certificate to ...
0
votes
0answers
34 views

Enumerate values of database column via error based SQL-injection?

I was reading about SQL-injection in SQL Server and I saw a technique that allows me to show any information from database via errors. Assume this is the vulnerable site: example.com/showproducts....
0
votes
0answers
68 views

Azure SQL Database and corporate networks

I have question around DLP from a corporate network. I have a Virtual Machine on a corporate network. The VM can access an Azure SQL DB in the cloud: aaa.database.windows.net However, I don't want ...
1
vote
0answers
41 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
0
votes
1answer
188 views

Can an ampersand (&) be used in SQL injection?

With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
0
votes
4answers
137 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
-1
votes
1answer
133 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
2
votes
1answer
287 views

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
1
vote
0answers
143 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
0
votes
0answers
31 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
0
votes
1answer
90 views

Database logs have multiple “Logon Login failed for user” from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
4
votes
1answer
135 views

What can I do with blind SQLi if the database is encrypted?

During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don't have access ...
0
votes
1answer
204 views

Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?

I've been working on an intranet web application that provides read/write, role-based access to a database. I have been asked to configure the IIS application to use an AD account for the Application ...
-1
votes
2answers
82 views

Secure access to an aplication from internet [closed]

I have an application wich needs to connect to the main database. I want this application to be accessible from outside the enterprise network. I think that the best way is to install the app in a SQL ...
2
votes
1answer
100 views

Can native SQL code be vulnerable? To what?

I was able to find an article that mentions that SQL injection can be done to SQL code in the following scenarios where stored procedures are involved: EXEC statements Dynamic Cursors Assuming SQLi ...
4
votes
2answers
639 views

Can 4 single quotes still be escaped producing a sql injection on sql server? [duplicate]

I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't ...
2
votes
1answer
102 views

SQL Security Questions

The CISO of my company is currently away and as IT manager I have been asked to send some security questions to a company hoping to implement an SQL database to manage salaries, orders etc. I have ...
10
votes
3answers
7k views

Sanitizing input for parameterized queries

If I use fully parameterized queries everywhere, is it still necessary and/or security-relevant to somehow sanitize input? E.g. check that mail addresses are valid before sending a parameterized query ...
1
vote
0answers
139 views

Sql Server access from DMZ

I'm developing a B2B website open to the internet. I've deployed the website on an application server that is in its own network and is only allowed to communicate to the intranet on two ports: To ...
1
vote
0answers
136 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
150 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
0
votes
2answers
430 views

What possible attacks might occur on a SQL Server TCP/IP port?

We have a VPS that contains a SQL Server Express instance. Using SQL Server Configuration we have enabled TCP/IP to listen on a random port, say 5741. We have disabled sa and created another user with ...
0
votes
1answer
76 views

Is a compromised SQL Server sa account without a domain login enough to access database?

If a SQL Server account with system administrator rights is compromised but there is no access to a domain account, port 1433 is not exposed outside of the corporate firewall and SQL injection is not ...
-1
votes
2answers
347 views

SQL injection - NEw attacks discovered on my site. Please advise

Recently discover someone doing the following seacrch queries on my website! 1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465,0x6461726b34636f6465-- 2620 3 ...
1
vote
2answers
171 views

Creat IIS USER in SQL from different machine [closed]

I am trying to create a IIS APPPOOL\poolName security login in SQL but getting this error "Windows NT user or group 'IIS APPPOOL\poolName' not found." I am doing this to run elmah. doing this from ...
0
votes
1answer
849 views

Block IP to SQL Server remote access

I find in my Windows Application logs many external IP addresses trying to connect to my SQL Server 2014. It keeps trying different usernames and passwords. SQL Server has remote access enabled as ...
2
votes
1answer
350 views

Why Microsoft claims that SQL Server is the least vulnerable database? [closed]

Microsoft claims in their official site that “SQL Server is the least vulnerable database for six years running in the NIST vulnerabilities database”, I reviewed the NIST web site, but I can’t find a ...
3
votes
1answer
199 views

First time penetration testing code check

In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the ...
3
votes
2answers
71 views

Security concerns with external MySQL access using tunnelling

I have gotten my personal vServer with a standard installation of Ubuntu Server 16.04 and I wanted to install and configure a MySQL server on it. I was considering to disable direct external access, ...
0
votes
1answer
683 views

Can be SQL Queries sniffed through the client network adapter?

This may not be a fully Security Question but here's the thing: We have a really old software (released in 2000) that manages some data in the company. Right now we have to create a report from this ...
1
vote
2answers
100 views

Is there any way of making an SQL server think I'm accessing from localhost?

The title is pretty much self explanatory If a SQL server only allows connections from localhost, is there any way I can access from the outside by making it think I'm actually accessing from ...
6
votes
3answers
25k views

Determine SSL/TLS version using Wireshark

Using Wireshark, I am trying to determine the version of SSL/TLS that is being used with the encryption of data between a client workstation and another workstation on the same LAN running SQL Server. ...
1
vote
0answers
80 views

Encrypt SQL Server traffic on a LAN

I have a .NET client application that runs on several machines on a local area network. All machines (including the server which is running MSSQL Server 2016) are running either Windows 7, 8 or 10. ...
4
votes
2answers
265 views

This is a working SQL-injection. What could the server side query string look like?

This question is about a small detail in a larger school assignment. I have been struggling with this little problem for too long. ABCTF arranged a Capture-the-Flag competition which was held earlier ...
2
votes
1answer
543 views

How can MS Access work with an encrypted field in a Linked SQL Server table?

I have an MS Access .accdb file that acts as a front-end to a SQL Server database. There is a table that holds SSNs in plain text. We want to encrypt those SSNs in the table so that, the user can ...
3
votes
1answer
90 views

Is it a security hole to have a stored procedure output the key and certificate names?

My scenario is this: (Following the method of opening keys, encrypting, and closing keys, found in Ben Cull's Blog.) Imagine you have a MS SQL sever with tons of keys for encrypting different ...
-4
votes
1answer
233 views

How can I exploit a SQL Injection based on time without using single-quotes?

I'm doing some test on a web application and I found a SQL Injection in a stored procedure. It's something like this: Stored_procedure [input] The stored procedure validates the input, it must be an ...
0
votes
2answers
83 views

Compromised server name and port number of a SQL Server DB Server

I would like to get an expert opinion on how dangerous is it to have the database server name and SQL server instance and port number compromised by accidentally exposing it in source code snippet ...
2
votes
1answer
93 views

Is internal or external hosting more secure? [closed]

I have been looking for a while to find out the number of malicious attacks that have been successful against internal vs externally hosted web and SQL solutions. When I say internal, I mean the ...
-3
votes
1answer
1k views

SQL Server infected with Troldesh ransomware with DB backup files [closed]

The SQL server was infected by a ransomware virus. Files has been modified as FileName.7z.id-38199C3A.diablo_diablo2@aol.com. Unfortunately all the DB backup files were also stored on the C: drive. I ...
5
votes
1answer
593 views

How does the client pick the correct certificate from its certificate store?

As I am able to configure my SQL Server and client to establish SSL connection, I have installed the certificate on the server as well as on the client machine (Trusted Root Certification Authorities ...
1
vote
1answer
100 views

Can we provide our external certificates to a customer's SQL Server for SSL?

In designing hosted software that interfaces with a client's SQL Server over TCP/IP and we may wish to offer the option of using SSL/TLS. One architecture that seems attractive is where we generate a ...
-4
votes
1answer
288 views

Safest SQL database [closed]

I am going to run a Tor Hidden Service on a Linux server. My site will have an SQL database. This DB contains user login, and a few other basic details. If it makes a difference depending on the ...
0
votes
1answer
429 views

Detecting datasets that were affected by SQL injection

Assuming that I know that one of my applications was attacked by an SQL injection, how can I identify edited or selected data sets? On obvious source are webserver logs. This should allow us to ...
7
votes
2answers
1k views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
1
vote
1answer
364 views

How to extract data from hackyourself legal site with table and column information?

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data. http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT ...
1
vote
1answer
570 views

Store SHA256 in sql-server

I need to develop a payment gateway and I've just realized I need to store an HMAC_SHA256_V1 key for authentication operations. The way that this is done is: the browser calls a WCF service that ...
2
votes
0answers
328 views

ISO27001 compliance and perceived Risks using Microsoft SQL Server Azure 2016 [closed]

Introduction My company is currently undergoing ISO27001 compliance. I originally thought that this is a purely technical issue, with the merits of different solutions being weighed up on purely ...
4
votes
1answer
2k views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...