Questions tagged [sql-server]

SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

Filter by
Sorted by
Tagged with
1
vote
1answer
86 views

Weird entry in SQL Server database, is this a result of SQL Injection?

I stumbled upon a case where several database entries were updated. And the update is rather unusual. For example if I have an entry named: Watermelon The updated version is: Watermelon<IMG SRC=&...
0
votes
0answers
33 views

SQL Column encryption can be part of Data at Rest?

I have a SQL database and I have enabled the Always Encrypted feature. Can I claim that Data at Rest is fulfilled? or do I have to secure the backup files using certificates to claim that our database ...
1
vote
2answers
81 views

SQL Server connections with TLS vs. through an encrypted tunnel?

I'm developing an application that will connect to Microsoft SQL Server in a local network: I'm considering whether these connections need to use TLS Or whether to leave it to the customer's ...
1
vote
2answers
99 views

How is TDS authentication data protected?

I'm currently testing an application, which connects to a MS-SQL database. Through Wireshark, I can see that the application uses TDS to connect to the database. Furthermore, I can see that both the ...
6
votes
4answers
3k views

Security risks of using SQL Server without a firewall

My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no ...
1
vote
1answer
63 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
1
vote
1answer
88 views

SQLinjection prevention: parser + blacklist?

I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly. So what my ...
0
votes
1answer
119 views

Does Injection Attack Against SQL Server Require Semicolon or Comment?

In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
1
vote
1answer
63 views

Direct VPN access to DBs - government guidelines (DBAs at home COVID)

We have DBAs who want to access SQL DBs over DirectAccess (DA). The ask is to open port TCP 1530 over DA. At the moment, we have 6,000 people using DA, we can't filter on a specific group of DBAs. ...
0
votes
0answers
106 views

SQL TDE - Benefits of using CA Signed Certificates over Self-Signed Certificates

It seems when SQL TDE is implemented certificates are used to protect the keys used to encrypt the data. What would be the benefits of using a CA signed certificate in this scenario over a self-signed ...
1
vote
1answer
61 views

What are the potential vulnerabilities of sending HTML/JS to the browser from the database?

An in-house team is creating a new framework and I'm not so sure it's as secure as they're letting on. I'm not super well versed in security so I wanted to ask for opinions. A demo web app was ...
5
votes
1answer
149 views

Giving different passwords to the app servers to access the same database. Pros and Cons?

Let's say we have one db server. three app servers with full database access. Which scenario is the best? Each app server connects to that one database with different passwords. Example: app srv 1 ...
0
votes
1answer
55 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
2
votes
2answers
101 views

Private way to connect to my SQL Server database

I'm running on linux and I am using a SQL Server database server on some other machine. My python code has to sit in a directory that many other users have read access to. I also have a "...
1
vote
1answer
774 views

Replaced single quote bypass for SQLi

I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this: sql="SELECT * FROM USERS_TABLE WHERE USER='" & user &...
0
votes
1answer
61 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
1
vote
0answers
41 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
1
vote
2answers
99 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
3
votes
1answer
540 views

What security implications are involved when using a CSV file to fill a SQL table?

I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers. I am using a script based on the one ...
3
votes
2answers
104 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
13
votes
2answers
2k views

Generating a PIN from cryptographic bytes

One of our applications uses SQL Server for the back end, and that application requires a 4 digit numerical PIN for employees to be created that works with a key (more or less). The system itself ...
1
vote
0answers
220 views

Disk Encryption VS SQL TDE Encryption

I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption. My understanding is that disk encryption will prevent malicious users pulling out the disk ...
0
votes
2answers
107 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
0
votes
0answers
2k views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
1
vote
2answers
130 views

Transactional replication through VPN, do I need to encrypt connection?

New to security. We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed ...
0
votes
0answers
375 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
1
vote
0answers
112 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
0
votes
2answers
895 views

Can an ampersand (&) be used in SQL injection?

With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
0
votes
4answers
485 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
-1
votes
1answer
253 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
2
votes
1answer
573 views

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
1
vote
0answers
289 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
0
votes
0answers
63 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
0
votes
1answer
547 views

Database logs have multiple “Logon Login failed for user” from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
4
votes
1answer
279 views

What can I do with blind SQLi if the database is encrypted?

During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don't have access ...
0
votes
1answer
893 views

Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?

I've been working on an intranet web application that provides read/write, role-based access to a database. I have been asked to configure the IIS application to use an AD account for the Application ...
-1
votes
2answers
104 views

Secure access to an aplication from internet [closed]

I have an application wich needs to connect to the main database. I want this application to be accessible from outside the enterprise network. I think that the best way is to install the app in a SQL ...
2
votes
1answer
171 views

Can native SQL code be vulnerable? To what?

I was able to find an article that mentions that SQL injection can be done to SQL code in the following scenarios where stored procedures are involved: EXEC statements Dynamic Cursors Assuming SQLi ...
4
votes
2answers
1k views

Can 4 single quotes still be escaped producing a sql injection on sql server? [duplicate]

I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't ...
2
votes
1answer
123 views

SQL Security Questions

The CISO of my company is currently away and as IT manager I have been asked to send some security questions to a company hoping to implement an SQL database to manage salaries, orders etc. I have ...
20
votes
3answers
38k views

Sanitizing input for parameterized queries

If I use fully parameterized queries everywhere, is it still necessary and/or security-relevant to somehow sanitize input? E.g. check that mail addresses are valid before sending a parameterized query ...
1
vote
0answers
217 views

Sql Server access from DMZ

I'm developing a B2B website open to the internet. I've deployed the website on an application server that is in its own network and is only allowed to communicate to the intranet on two ports: To ...
1
vote
0answers
279 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
172 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
0
votes
2answers
2k views

What possible attacks might occur on a SQL Server TCP/IP port?

We have a VPS that contains a SQL Server Express instance. Using SQL Server Configuration we have enabled TCP/IP to listen on a random port, say 5741. We have disabled sa and created another user with ...
0
votes
1answer
96 views

Is a compromised SQL Server sa account without a domain login enough to access database?

If a SQL Server account with system administrator rights is compromised but there is no access to a domain account, port 1433 is not exposed outside of the corporate firewall and SQL injection is not ...
-1
votes
2answers
844 views

SQL injection - NEw attacks discovered on my site. Please advise

Recently discover someone doing the following seacrch queries on my website! 1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465,0x6461726b34636f6465-- 2620 3 ...
1
vote
2answers
430 views

Creat IIS USER in SQL from different machine [closed]

I am trying to create a IIS APPPOOL\poolName security login in SQL but getting this error "Windows NT user or group 'IIS APPPOOL\poolName' not found." I am doing this to run elmah. doing this from ...
0
votes
1answer
2k views

Block IP to SQL Server remote access

I find in my Windows Application logs many external IP addresses trying to connect to my SQL Server 2014. It keeps trying different usernames and passwords. SQL Server has remote access enabled as ...
2
votes
1answer
446 views

Why Microsoft claims that SQL Server is the least vulnerable database? [closed]

Microsoft claims in their official site that “SQL Server is the least vulnerable database for six years running in the NIST vulnerabilities database”, I reviewed the NIST web site, but I can’t find a ...