Questions tagged [sql-server]

SQL Server is Microsoft's relational database management system (RDBMS). It is a full-featured databse primarily designed to compete against competitors Oracle Database (DB) and MySQL.

Filter by
Sorted by
Tagged with
0
votes
1answer
105 views

Desktop App with SQL Server security issues

I'm in a discussion with Information Security team about a legacy Desktop Application accessing a SQL Server database directly using LINQtoSQL. The Information Security team insists that there are ...
0
votes
0answers
48 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
0
votes
0answers
78 views

Is this stored procedure vulnerable to SQL injection?

My question is about what exploits are possible given the following, not how to prevent SQL injection. I would not use this code in a real application. Using MSSQL Server 2019, imagine a stored ...
0
votes
2answers
190 views

How do I secure SQL passwords when distributing executables?

Environment I am creating a python application which writes to SQL. It is compiled into an .exe and distributed to other computers in the business. (Edit: The SQL server is hosted by our business, ...
0
votes
0answers
68 views

Equivalence of UNC Path Injection and Kerberoasting Attacks on SQL Server

An Active Directory domain is deployed, a domain controller on Windows Server 2019. A computer with SQL Server 2016 is added to it, which is launched under the srv service account. The attacker has ...
0
votes
0answers
87 views

Blind MSSQL Injection - Stacked query in cookies

I am currently working on a bug bounty program and in one subdomain of my target there is a Blind SQL flaw in a cookie. The back-end is MSSQL/ASP.net however, since cookies are separated by semicolons ...
0
votes
2answers
79 views

What are the security vulnerability of letting users insert anything to a nvarchar sql column?

I have several Web APIs that are used by the UI, for these APIs I have several validations that prevent users from adding invalid data. On the other hand, I have some APIs that are not used by any UI, ...
1
vote
1answer
165 views

Weird entry in SQL Server database, is this a result of SQL Injection?

I stumbled upon a case where several database entries were updated. And the update is rather unusual. For example if I have an entry named: Watermelon The updated version is: Watermelon<IMG SRC=&...
1
vote
2answers
254 views

SQL Server connections with TLS vs. through an encrypted tunnel?

I'm developing an application that will connect to Microsoft SQL Server in a local network: I'm considering whether these connections need to use TLS Or whether to leave it to the customer's ...
0
votes
0answers
62 views

SQL Column encryption can be part of Data at Rest?

I have a SQL database and I have enabled the Always Encrypted feature. Can I claim that Data at Rest is fulfilled? or do I have to secure the backup files using certificates to claim that our database ...
1
vote
2answers
326 views

How is TDS authentication data protected?

I'm currently testing an application, which connects to a MS-SQL database. Through Wireshark, I can see that the application uses TDS to connect to the database. Furthermore, I can see that both the ...
6
votes
4answers
3k views

Security risks of using SQL Server without a firewall

My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no ...
1
vote
1answer
128 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
1
vote
1answer
4k views

What AES mode does SQL Server 2012 use?

I looked at this link that shows how to encrypt a SQL column via a certificate (RSA??) and AES256. I created a dummy table (script at GitHub) intentionally using identical plain text (Credit Card = ...
1
vote
1answer
126 views

SQLinjection prevention: parser + blacklist?

I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly. So what my ...
0
votes
1answer
203 views

Does Injection Attack Against SQL Server Require Semicolon or Comment?

In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
1
vote
1answer
93 views

Direct VPN access to DBs - government guidelines (DBAs at home COVID)

We have DBAs who want to access SQL DBs over DirectAccess (DA). The ask is to open port TCP 1530 over DA. At the moment, we have 6,000 people using DA, we can't filter on a specific group of DBAs. ...
2
votes
2answers
132 views

Private way to connect to my SQL Server database

I'm running on linux and I am using a SQL Server database server on some other machine. My python code has to sit in a directory that many other users have read access to. I also have a "...
0
votes
0answers
187 views

SQL TDE - Benefits of using CA Signed Certificates over Self-Signed Certificates

It seems when SQL TDE is implemented certificates are used to protect the keys used to encrypt the data. What would be the benefits of using a CA signed certificate in this scenario over a self-signed ...
1
vote
1answer
90 views

What are the potential vulnerabilities of sending HTML/JS to the browser from the database?

An in-house team is creating a new framework and I'm not so sure it's as secure as they're letting on. I'm not super well versed in security so I wanted to ask for opinions. A demo web app was ...
5
votes
1answer
200 views

Giving different passwords to the app servers to access the same database. Pros and Cons?

Let's say we have one db server. three app servers with full database access. Which scenario is the best? Each app server connects to that one database with different passwords. Example: app srv 1 ...
1
vote
1answer
1k views

Replaced single quote bypass for SQLi

I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this: sql="SELECT * FROM USERS_TABLE WHERE USER='" & user &...
1
vote
1answer
736 views

How to extract data from hackyourself legal site with table and column information?

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data. http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT ...
0
votes
1answer
96 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
5
votes
4answers
3k views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
0
votes
2answers
149 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
0
votes
4answers
8k views

Database connection from front end [closed]

I want to know why calling a database from the front end is considered a bad practice for security. It is really so bad as to justify building an application layer with all its drawbacks: costs, ...
1
vote
0answers
77 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
4
votes
1answer
756 views

What security implications are involved when using a CSV file to fill a SQL table?

I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers. I am using a script based on the one ...
1
vote
2answers
131 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
3
votes
2answers
135 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
13
votes
2answers
2k views

Generating a PIN from cryptographic bytes

One of our applications uses SQL Server for the back end, and that application requires a 4 digit numerical PIN for employees to be created that works with a key (more or less). The system itself ...
1
vote
0answers
264 views

Disk Encryption VS SQL TDE Encryption

I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption. My understanding is that disk encryption will prevent malicious users pulling out the disk ...
0
votes
0answers
2k views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
1
vote
2answers
185 views

Transactional replication through VPN, do I need to encrypt connection?

New to security. We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed ...
0
votes
2answers
1k views

Can an ampersand (&) be used in SQL injection?

With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
1
vote
0answers
149 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
0
votes
0answers
446 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
-1
votes
2answers
898 views

SQL injection - NEw attacks discovered on my site. Please advise

Recently discover someone doing the following seacrch queries on my website! 1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465,0x6461726b34636f6465-- 2620 3 ...
0
votes
4answers
675 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
-1
votes
1answer
286 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
2
votes
1answer
634 views

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
1
vote
0answers
333 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
4
votes
2answers
2k views

Can 4 single quotes still be escaped producing a sql injection on sql server? [duplicate]

I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't ...
0
votes
0answers
95 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
0
votes
1answer
665 views

Database logs have multiple "Logon Login failed for user" from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
4
votes
1answer
344 views

What can I do with blind SQLi if the database is encrypted?

During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don't have access ...
2
votes
1answer
368 views

First time penetration testing code check

In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the ...
0
votes
2answers
514 views

SQL Server Format-Preserving encryption

I have old system with database that has table with column of type char(20) and the customer decided to encrypt that column for some business needs however for some system integration needs the ...
2
votes
1answer
211 views

Can native SQL code be vulnerable? To what?

I was able to find an article that mentions that SQL injection can be done to SQL code in the following scenarios where stored procedures are involved: EXEC statements Dynamic Cursors Assuming SQLi ...