Hot answers tagged

143 votes
Accepted

Why can't I just let customers connect directly to my database?

TL,DR: Don't. (My-)SQL permissions are pretty fine-grained, so I'd wager there shouldn't be any obvious security issues Even with permission on the record level, it does not scale easy. If a user ...
user avatar
  • 50.5k
84 votes

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python ...
user avatar
  • 12.7k
80 votes
Accepted

How to limit the impact of and reduce the risk of SQL injection for existing website?

Don't spend lots of time on workarounds or half fixes. Every minute you spend trying to implement anything suggested here is a minute you could have spent implementing prepared statements. That is the ...
user avatar
  • 64.2k
75 votes
Accepted

Is SQL injection possible with LIMIT?

You can make a UNION SELECT here. The only problem is to match the columns from messages, but you can guess those by adding columns until it fits: SELECT * FROM messages WHERE unread = 1 LIMIT 1 ...
user avatar
  • 5,404
68 votes

Why can't I just let customers connect directly to my database?

Interesting question. In theory, this can be done securely. MS-SQL can secure the connection with encryption, authenticate the user, and provides fine-grained permissions and other security features ...
user avatar
  • 32.6k
68 votes
Accepted

CRM with Client Side Encryption

Your company should hire a security expert to help with the project, and start fresh. I know that not answering your immediate technical questions might seem frustrating, but I can promise you that no ...
user avatar
  • 131k
67 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

The problem of SQL injection is essentially the mixing of logic and data, where what should be data is treated as logic. Prepared statements and parameterized queries actually solve this issue at the ...
user avatar
65 votes

How to limit the impact of and reduce the risk of SQL injection for existing website?

The only correct way is to use prepared statements. If you disguise error messages, it a bit harder, but won't stop attackers. You can restrict the rights, but all rights granted to the user could ...
user avatar
  • 824
59 votes
Accepted

Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query?

From the documentation: From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control ...
user avatar
58 votes

Why can't I just let customers connect directly to my database?

I've built both RESTful interfaces and provided customers with direct SQL access. The problem here is that the question is fundamentally flawed: Lots of the work backend developers do is providing ...
user avatar
  • 680
48 votes

How can I secure MySQL against bruteforce attacks?

The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback ...
user avatar
  • 17.4k
39 votes

Should I obscure database primary keys (IDs) in application front end?

The only piece of information that you could hope to "hide" is the sequence: since a database will allocate primary key values with a counter, people who see they key can make a guess as to when the ...
user avatar
39 votes
Accepted

Second order SQL injection protection

A second order SQL injection is an injection where the payload is already stored in the database (instead of say being delivered in a GET parameter). In that sense it is somewhat similar to stored XSS ...
user avatar
  • 64.2k
39 votes

Is password information dumped from the MySQL user table sensitive?

Yes, it's sensitive information. It's a password hash leak. Attackers will supply this information to a bruteforce application (there are some tailored just for MySQL) and retrieve the password. Not ...
user avatar
  • 50.5k
37 votes

Why can't I just let customers connect directly to my database?

Performance You say that performance should be "way better", except that now you've just given malicious actors complete authority to wreck the performance of your DB. Of course, they have to ...
user avatar
35 votes

Can I recover a lost AES key?

Realistically, no you cannot. AES is very resistant to known plaint text attacks like most block ciphers. It's lucky you didn't lose any information and have the original database backup because your ...
user avatar
  • 311
33 votes

Sql database password encryption opinion needed

No, this is not a good idea! As Lukas pointed out in an comment, you want to hash a password, never encrypt it! With your schema, it would be possible to get the plaintext passwords from an database ...
user avatar
  • 5,913
31 votes

Should I obscure database primary keys (IDs) in application front end?

One easy way would be to use the method youtube and other websites use. This is hashids (http://hashids.org). With this method you can give links like: http://www.example.org/user/fce7db/edit while ...
user avatar
29 votes
Accepted

Understanding SQL injection payload

What does (@) and (@:=0x00) stand for in this payload? @ - is the variable name @:=0x00 - is the assignment of zero into this variable. Note: := is the assignment-operator Thanks for @Frank Cedeno ...
user avatar
  • 512
28 votes
Accepted

Should I remotely store my salt?

It is not a problem if the attacker learns the salts. Salts are not meant to be secret. What is important for a salt is that it is unique for each hashed password instance (i.e. not only a unique salt ...
user avatar
  • 168k
26 votes

How to limit the impact of and reduce the risk of SQL injection for existing website?

We know, but we do not have enough developers/testers to make it 100% safe. This is the real problem. Until you hire more people or reassign priorities, you're not safe. Stopping 99.9% of attackers ...
user avatar
  • 388
26 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

I think the main question here is why string escaping is not as good as the other methods. The answer is that some edge cases allow injections to slip through even though they are escaped. Stack ...
user avatar
  • 801
25 votes
Accepted

Sanitizing input for parameterized queries

No, it's not necessary. But please, read on. Input sanitization is a horrible term that pretends you can wave a magic wand at data and make it "safe data". The problem is that the definition of "safe"...
user avatar
  • 898
22 votes
Accepted

Website Login Security (Secure enough?)

The worst case scenario you have to protect against is an attacker which completely compromises your server and obtains your sourcecode, your config and a dump of your database. Keep that in mind. ...
user avatar
  • 48.8k
20 votes
Accepted

What is the meaning of "something AND 1=0" command in SQL?

The fragment AND 1=0 always evaluates to false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is SELECT * FROM users WHERE username = '<...
user avatar
  • 2,247
19 votes

Why can't I just let customers connect directly to my database?

This could be a reasonable approach in certain circumstances: The customer gets read-only access. They get read access to an entire database: it's either quasi-public data to all your customers, or ...
user avatar
  • 303
18 votes
Accepted

Is it not safe to open MySQL's port to the internet?

If it's not needed, it should be closed. Vulnerabilities You can never be sure if there are no vulnerabilities in MySQL itself. Here is an example for a DOS attack (and it's not the only possible ...
user avatar
  • 29k
18 votes
Accepted

When viewing my website from port 3306, I see some weird MySQL info

I see two options here: Local Access Only Configure MySQL Server to only listen on TCP port 3306 on 127.0.0.1 (localhost). This way an internal web server can still communicate with the database ...
user avatar
  • 5,773
17 votes
Accepted

Is forbiding the ; char enough to prevent SQL injection?

TL;DR No, your friend is not right. INSERT, UPDATE, DELETE and DROP TABLE aren't the be-all and end-all of SQL risks connected to SQL injection. The very simplest thing I could do with that query is ...
user avatar
  • 22.5k
16 votes
Accepted

How does stored procedure prevents SQL injection?

Stored procedures are a form of parameterised query. The fundamental problem that causes SQL injection is data being treated as query language. $query = "SELECT * FROM users WHERE username = '$...
user avatar
  • 131k

Only top scored, non community-wiki answers of a minimum length are eligible