Questions tagged [sql-server]

SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

Filter by
Sorted by
Tagged with
0 votes
1 answer
47 views

Is using newsequentialid bad?

I found a project that uses T-SQL's newsequentialid() for one of their external ID columns which is used for public APIs. When that column is added to an existing table, each row gets an incremented ...
user avatar
0 votes
1 answer
84 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...
user avatar
0 votes
1 answer
127 views

sqlmap is encountering 403 forbidden

I am trying to complete an SQL injection CTF here. I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
user avatar
1 vote
1 answer
127 views

Why does this SQL injection have an equals symbol?

I was reading into the basics of SQL injection attacks on w3schools here. In the second example, I was curious as to why the equal sign was used. I have quoted within the line below. " or "&...
user avatar
-3 votes
1 answer
77 views

Decode Encrypted Password help me [duplicate]

Help me to decode belove password 68H++v5FX/kUty5/itzflw== Above is password store in sql table
user avatar
0 votes
0 answers
93 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
user avatar
0 votes
0 answers
92 views

Is this stored procedure vulnerable to SQL injection?

My question is about what exploits are possible given the following, not how to prevent SQL injection. I would not use this code in a real application. Using MSSQL Server 2019, imagine a stored ...
user avatar
  • 1
0 votes
2 answers
208 views

How do I secure SQL passwords when distributing executables?

Environment I am creating a python application which writes to SQL. It is compiled into an .exe and distributed to other computers in the business. (Edit: The SQL server is hosted by our business, ...
user avatar
0 votes
0 answers
116 views

Equivalence of UNC Path Injection and Kerberoasting Attacks on SQL Server

An Active Directory domain is deployed, a domain controller on Windows Server 2019. A computer with SQL Server 2016 is added to it, which is launched under the srv service account. The attacker has ...
user avatar
  • 13
0 votes
0 answers
153 views

Blind MSSQL Injection - Stacked query in cookies

I am currently working on a bug bounty program and in one subdomain of my target there is a Blind SQL flaw in a cookie. The back-end is MSSQL/ASP.net however, since cookies are separated by semicolons ...
user avatar
0 votes
2 answers
98 views

What are the security vulnerability of letting users insert anything to a nvarchar sql column?

I have several Web APIs that are used by the UI, for these APIs I have several validations that prevent users from adding invalid data. On the other hand, I have some APIs that are not used by any UI, ...
user avatar
  • 101
1 vote
2 answers
258 views

Weird entry in SQL Server database, is this a result of SQL Injection?

I stumbled upon a case where several database entries were updated. And the update is rather unusual. For example if I have an entry named: Watermelon The updated version is: Watermelon<IMG SRC=&...
user avatar
1 vote
2 answers
383 views

SQL Server connections with TLS vs. through an encrypted tunnel?

I'm developing an application that will connect to Microsoft SQL Server in a local network: I'm considering whether these connections need to use TLS Or whether to leave it to the customer's ...
user avatar
  • 111
1 vote
2 answers
799 views

How is TDS authentication data protected?

I'm currently testing an application, which connects to a MS-SQL database. Through Wireshark, I can see that the application uses TDS to connect to the database. Furthermore, I can see that both the ...
user avatar
6 votes
4 answers
3k views

Security risks of using SQL Server without a firewall

My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no ...
user avatar
  • 181
1 vote
1 answer
165 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
user avatar
1 vote
1 answer
149 views

SQLinjection prevention: parser + blacklist?

I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly. So what my ...
user avatar
  • 111
0 votes
1 answer
282 views

Does Injection Attack Against SQL Server Require Semicolon or Comment?

In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
user avatar
2 votes
2 answers
143 views

Is using EXECUTE AS impersonation for user authentication in a web application a good idea?

I wrote a web application that is using AD authentication (Windows) and has its own authorization module (RBAC-like). Back-end is Microsoft SQL Server. A DBA on my team is not happy with us using a ...
user avatar
  • 21
1 vote
1 answer
96 views

Direct VPN access to DBs - government guidelines (DBAs at home COVID)

We have DBAs who want to access SQL DBs over DirectAccess (DA). The ask is to open port TCP 1530 over DA. At the moment, we have 6,000 people using DA, we can't filter on a specific group of DBAs. ...
user avatar
  • 71
0 votes
0 answers
262 views

SQL TDE - Benefits of using CA Signed Certificates over Self-Signed Certificates

It seems when SQL TDE is implemented certificates are used to protect the keys used to encrypt the data. What would be the benefits of using a CA signed certificate in this scenario over a self-signed ...
user avatar
1 vote
1 answer
98 views

What are the potential vulnerabilities of sending HTML/JS to the browser from the database?

An in-house team is creating a new framework and I'm not so sure it's as secure as they're letting on. I'm not super well versed in security so I wanted to ask for opinions. A demo web app was ...
user avatar
  • 19
5 votes
1 answer
246 views

Giving different passwords to the app servers to access the same database. Pros and Cons?

Let's say we have one db server. three app servers with full database access. Which scenario is the best? Each app server connects to that one database with different passwords. Example: app srv 1 ...
user avatar
0 votes
1 answer
123 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
user avatar
2 votes
2 answers
141 views

Private way to connect to my SQL Server database

I'm running on linux and I am using a SQL Server database server on some other machine. My python code has to sit in a directory that many other users have read access to. I also have a "...
user avatar
1 vote
1 answer
2k views

Replaced single quote bypass for SQLi

I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this: sql="SELECT * FROM USERS_TABLE WHERE USER='" & user &...
user avatar
0 votes
1 answer
101 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
user avatar
  • 121
1 vote
0 answers
90 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
user avatar
  • 13
1 vote
2 answers
139 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
user avatar
4 votes
1 answer
943 views

What security implications are involved when using a CSV file to fill a SQL table?

I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers. I am using a script based on the one ...
user avatar
3 votes
2 answers
141 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
user avatar
13 votes
2 answers
2k views

Generating a PIN from cryptographic bytes

One of our applications uses SQL Server for the back end, and that application requires a 4 digit numerical PIN for employees to be created that works with a key (more or less). The system itself ...
user avatar
1 vote
0 answers
282 views

Disk Encryption VS SQL TDE Encryption

I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption. My understanding is that disk encryption will prevent malicious users pulling out the disk ...
user avatar
  • 217
0 votes
2 answers
160 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
user avatar
  • 115
0 votes
0 answers
2k views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
user avatar
  • 101
1 vote
2 answers
203 views

Transactional replication through VPN, do I need to encrypt connection?

New to security. We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed ...
user avatar
0 votes
0 answers
522 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
user avatar
1 vote
0 answers
169 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
user avatar
  • 111
0 votes
2 answers
1k views

Can an ampersand (&) be used in SQL injection?

With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
user avatar
0 votes
4 answers
722 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
user avatar
-1 votes
1 answer
297 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
user avatar
2 votes
1 answer
688 views

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
user avatar
  • 23
1 vote
0 answers
360 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
user avatar
0 votes
0 answers
102 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
user avatar
0 votes
1 answer
722 views

Database logs have multiple "Logon Login failed for user" from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
user avatar
  • 453
4 votes
1 answer
372 views

What can I do with blind SQLi if the database is encrypted?

During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don't have access ...
user avatar
  • 345
0 votes
1 answer
1k views

Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?

I've been working on an intranet web application that provides read/write, role-based access to a database. I have been asked to configure the IIS application to use an AD account for the Application ...
user avatar
  • 137
-1 votes
2 answers
145 views

Secure access to an aplication from internet [closed]

I have an application wich needs to connect to the main database. I want this application to be accessible from outside the enterprise network. I think that the best way is to install the app in a SQL ...
user avatar
  • 101
2 votes
1 answer
223 views

Can native SQL code be vulnerable? To what?

I was able to find an article that mentions that SQL injection can be done to SQL code in the following scenarios where stored procedures are involved: EXEC statements Dynamic Cursors Assuming SQLi ...
user avatar
  • 443
4 votes
2 answers
2k views

Can 4 single quotes still be escaped producing a sql injection on sql server? [duplicate]

I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't ...
user avatar
  • 41