Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [sql-server]

SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

Filter by
Sorted by
Tagged with
2 votes
1 answer
65 views

sqlmap cannot detect a confirmed vulnerability

I have a verified injection which looks like: /page/(SELECT+SLEEP(10)) But sqlmap cannot detect it no matter what. This is how I'm running sqlmap: sqlmap -u 'http://MY-SITE/page/*' --level=5 --risk=3 -...
Sohail Saha's user avatar
1 vote
1 answer
60 views

xp_cmdshell as dbo user only able to run 'ping localhost' to verify RCE?

I am doing a pentest on a client's ASP web application and I have identified a blind SQL injection. However, after enabling xp_cmdshell, I am only able to run the ping localhost command to verify the ...
dawn breaker's user avatar
0 votes
0 answers
116 views

Secure authentication method for creating an Excel data connection to SQL Server

My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
DougM's user avatar
  • 1
1 vote
0 answers
264 views

Which is safer - using the sql_conn Flutter package or using a web server as a middle layer for requests against a SQL Server database?

We are currently working on setting up new Android handheld devices (RF guns) to read/write to our SQL Server 2019 database and are at a fork in the road in deciding what to do. Both options below ...
TheMortiestMorty's user avatar
4 votes
2 answers
612 views

How to find the process that is running PowerShell commands that appear in Windows Defender

On one of our Windows Datacenter 2016, there's an alert that a trojan is trying to install : The following PowerShell commands are trying to execute at seemingly random hours of the day (always ...
Maxime's user avatar
  • 139
0 votes
1 answer
113 views

How spamming entries in website database using the same IP address is possible?

I am working in a private company as VAPT Auditor. I am currently testing one of our project website which contains common features like login, sign up, etc. I mostly do manual testing using BurpSuite ...
Solo's user avatar
  • 31
4 votes
0 answers
411 views

Securely store application secrets in production without 3rd party KMS

Integrated Security I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
JCasper's user avatar
  • 41
0 votes
1 answer
193 views

Is using newsequentialid bad?

I found a project that uses T-SQL's newsequentialid() for one of their external ID columns which is used for public APIs. When that column is added to an existing table, each row gets an incremented ...
David Klempfner's user avatar
0 votes
1 answer
172 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...
questioner's user avatar
1 vote
1 answer
6k views

sqlmap is encountering 403 forbidden

I am trying to complete an SQL injection CTF here. I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
questioner's user avatar
1 vote
1 answer
755 views

Why does this SQL injection have an equals symbol?

I was reading into the basics of SQL injection attacks on w3schools here. In the second example, I was curious as to why the equal sign was used. I have quoted within the line below. " or "&...
questioner's user avatar
-3 votes
1 answer
292 views

Decode Encrypted Password help me [duplicate]

Help me to decode belove password 68H++v5FX/kUty5/itzflw== Above is password store in sql table
Nikunj Chovatiya's user avatar
1 vote
0 answers
232 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
NicholaiRen's user avatar
0 votes
0 answers
376 views

Is this stored procedure vulnerable to SQL injection?

My question is about what exploits are possible given the following, not how to prevent SQL injection. I would not use this code in a real application. Using MSSQL Server 2019, imagine a stored ...
Fred's user avatar
  • 1
0 votes
2 answers
397 views

How do I secure SQL passwords when distributing executables?

Environment I am creating a python application which writes to SQL. It is compiled into an .exe and distributed to other computers in the business. (Edit: The SQL server is hosted by our business, ...
Jordan Wirth's user avatar
1 vote
1 answer
484 views

Blind MSSQL Injection - Stacked query in cookies

I am currently working on a bug bounty program and in one subdomain of my target there is a Blind SQL flaw in a cookie. The back-end is MSSQL/ASP.net however, since cookies are separated by semicolons ...
TyrionBuggy's user avatar
0 votes
2 answers
166 views

What are the security vulnerability of letting users insert anything to a nvarchar sql column?

I have several Web APIs that are used by the UI, for these APIs I have several validations that prevent users from adding invalid data. On the other hand, I have some APIs that are not used by any UI, ...
Hamid's user avatar
  • 101
1 vote
2 answers
525 views

Weird entry in SQL Server database, is this a result of SQL Injection?

I stumbled upon a case where several database entries were updated. And the update is rather unusual. For example if I have an entry named: Watermelon The updated version is: Watermelon<IMG SRC=&...
spitfire's user avatar
1 vote
2 answers
1k views

SQL Server connections with TLS vs. through an encrypted tunnel?

I'm developing an application that will connect to Microsoft SQL Server in a local network: I'm considering whether these connections need to use TLS Or whether to leave it to the customer's ...
symbiont's user avatar
  • 111
1 vote
2 answers
2k views

How is TDS authentication data protected?

I'm currently testing an application, which connects to a MS-SQL database. Through Wireshark, I can see that the application uses TDS to connect to the database. Furthermore, I can see that both the ...
user avatar
6 votes
4 answers
3k views

Security risks of using SQL Server without a firewall

My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no ...
BVernon's user avatar
  • 181
1 vote
1 answer
329 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
Matteo Dal Grande's user avatar
1 vote
1 answer
343 views

SQLinjection prevention: parser + blacklist?

I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly. So what my ...
kappadoky's user avatar
  • 111
0 votes
1 answer
732 views

Does Injection Attack Against SQL Server Require Semicolon or Comment?

In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
John Waller's user avatar
2 votes
2 answers
178 views

Is using EXECUTE AS impersonation for user authentication in a web application a good idea?

I wrote a web application that is using AD authentication (Windows) and has its own authorization module (RBAC-like). Back-end is Microsoft SQL Server. A DBA on my team is not happy with us using a ...
NotADba's user avatar
  • 21
1 vote
1 answer
128 views

Direct VPN access to DBs - government guidelines (DBAs at home COVID)

We have DBAs who want to access SQL DBs over DirectAccess (DA). The ask is to open port TCP 1530 over DA. At the moment, we have 6,000 people using DA, we can't filter on a specific group of DBAs. ...
Jay 's user avatar
  • 71
0 votes
0 answers
547 views

SQL TDE - Benefits of using CA Signed Certificates over Self-Signed Certificates

It seems when SQL TDE is implemented certificates are used to protect the keys used to encrypt the data. What would be the benefits of using a CA signed certificate in this scenario over a self-signed ...
user1876202's user avatar
1 vote
1 answer
134 views

What are the potential vulnerabilities of sending HTML/JS to the browser from the database?

An in-house team is creating a new framework and I'm not so sure it's as secure as they're letting on. I'm not super well versed in security so I wanted to ask for opinions. A demo web app was ...
Haruku's user avatar
  • 19
5 votes
1 answer
549 views

Giving different passwords to the app servers to access the same database. Pros and Cons?

Let's say we have one db server. three app servers with full database access. Which scenario is the best? Each app server connects to that one database with different passwords. Example: app srv 1 ...
Dave Doga Oz's user avatar
2 votes
2 answers
354 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
RobertoOSantos's user avatar
2 votes
2 answers
194 views

Private way to connect to my SQL Server database

I'm running on linux and I am using a SQL Server database server on some other machine. My python code has to sit in a directory that many other users have read access to. I also have a "...
DNS_Jeezus's user avatar
1 vote
1 answer
5k views

Replaced single quote bypass for SQLi

I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this: sql="SELECT * FROM USERS_TABLE WHERE USER='" & user &...
OscarAkaElvis's user avatar
0 votes
1 answer
145 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
Danny's user avatar
  • 121
1 vote
0 answers
142 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
secanon's user avatar
  • 13
1 vote
2 answers
170 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
bain2236's user avatar
5 votes
1 answer
1k views

What security implications are involved when using a CSV file to fill a SQL table?

I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers. I am using a script based on the one ...
techguy1029's user avatar
3 votes
2 answers
198 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
Alex Denton's user avatar
13 votes
2 answers
2k views

Generating a PIN from cryptographic bytes

One of our applications uses SQL Server for the back end, and that application requires a 4 digit numerical PIN for employees to be created that works with a key (more or less). The system itself ...
Bacon Bits's user avatar
1 vote
0 answers
381 views

Disk Encryption VS SQL TDE Encryption

I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption. My understanding is that disk encryption will prevent malicious users pulling out the disk ...
deltzy's user avatar
  • 237
0 votes
2 answers
210 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
PDHide's user avatar
  • 115
0 votes
0 answers
2k views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
Matthew's user avatar
  • 101
1 vote
2 answers
309 views

Transactional replication through VPN, do I need to encrypt connection?

New to security. We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed ...
securityg's user avatar
0 votes
0 answers
701 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
user1447679's user avatar
1 vote
0 answers
226 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
SoftEngi's user avatar
  • 111
0 votes
2 answers
1k views

Can an ampersand (&) be used in SQL injection?

With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
user1447679's user avatar
0 votes
4 answers
841 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
Rifat Shommo's user avatar
-1 votes
1 answer
346 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
Rifat Shommo's user avatar
2 votes
1 answer
964 views

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
Vincent's user avatar
  • 23
1 vote
0 answers
438 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
mappingman's user avatar
0 votes
0 answers
141 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
Ayan Mullick's user avatar