82 votes

Is this a SQL injection attack or is it some sort of bug?

This is the result of someone trying to exploit an SQL injection on your site. Someone tried to detect if your website was vulnerable to a union-based injection. For all the records that you see, it ...
user avatar
  • 3,623
42 votes
Accepted

Is this a SQL injection attack or is it some sort of bug?

Have a look at "Union Injection" SQL attacks such as found here. Basically, it's trying various methods to identify the number of columns in the query, looking for one which is successful. The order ...
user avatar
  • 27.2k
31 votes

Is this a SQL injection attack or is it some sort of bug?

In addition to the good answers already given, stating that these are probably signs of unsuccessful attempts, I would like to add that these user ids may be part of a more elaborate successful ...
user avatar
  • 411
21 votes
Accepted

Is Postgres's uuid_generate_v4 securely random?

The PostgreSQL documentation says that UUID generation relies on the OSSP library. A look at the source code of OSSP (version 1.6.2) shows that the code uses /dev/urandom on Unix-like systems (...
user avatar
15 votes

Permanently delete a record

The more layers you add above the actual data, the harder it will be to securely erase it, because it could have been stored in caches, journals, etc. Most SQL databases first store information for ...
user avatar
11 votes

Is Postgres password-based authentication secure?

Yes, using MD5 is safe. When a client wants to authenticate, the server sends a random salt value. The client uses that value, along with the password to generate a MD5 hash. Because a random salt ...
user avatar
9 votes

Postgres protection from SQL Injection

The same as any other database using SQL, use the following (taken from the OWASP cheat sheet) Option #1: Use of Prepared Statements (Parameterized Queries) Option #2: Use of Stored Procedures Option ...
user avatar
  • 61.4k
7 votes

Postgres protection from SQL Injection

SQL injection is an application threat, not a database threat. In the end, all relational databases execute the SQL which is passed to them as a string. And it is the responsibility of the application ...
user avatar
  • 191
7 votes

Allowing users to input raw SQL in update statement safely

Restricted user accounts Sanitizing such a query securely may be very, very hard and you should expect that you might have failed in some way which allows the users to execute arbitrary sql. A ...
user avatar
  • 8,370
6 votes

How secure is pgAdmin to save database password?

In pgAdmin 4.x the password file location can be specified in GUI whereas pgAdmin III has a fixed path. Both documentations refers to the PostgreSQL libpq (C Library) documentation for The Password ...
user avatar
  • 15.9k
5 votes
Accepted

Postgres password security

Postgres uses MD5 as algorithm with the username as "salt". Using a salt normally prevents computation of hashes, for example in rainbow tables. Using the username as salt only partially covers this ...
user avatar
  • 28.6k
4 votes
Accepted

SQL injection on PostgreSQL in integer field?

It's not an SQL injection, and shouldn't be directly exploitable as one, since you've used a named parameter (:sendTo) instead of directly concatenating strings. However, it is indeed exploitable, ...
user avatar
  • 305
4 votes
Accepted

Public guest user for PostgreSQL?

You already mentioned some of the problems: misconfiguration is easy, privilege escalation bugs could put you at risk, offering raw, more or less uncontrolled access to the data can lead to DOS ...
user avatar
  • 14.3k
4 votes
Accepted

Metasploit Search Multiple Keywords

TL;DR - upgrade, it works like you expect now. In versions before 4.13.8, search used a union instead of an intersection of results. Thus your example ("search platform:windows type:exploit") would ...
user avatar
  • 311
4 votes
Accepted

Is it safe to set rejectUnauthorized to false when using Heroku's Postgres database?

Heroku does not support client-side certificate validation to its Postgres databases unless you are using Private Spaces or Shield: Unless you're using a Private or Shield Heroku Postgres database, ...
user avatar
  • 156
3 votes

Is Postgres password-based authentication secure?

TLDR. It can be secure if you configure it properly and use good long passwords. 1. In postgres the md5 auth-method means client-side hashing (discussions: 1, 2), which makes hashes password ...
user avatar
  • 183
3 votes
Accepted

Thousands of 28000 "no pg_hba.conf entry for host" logs from Postgres - is this an attack?

I've seen the same behavior in a few of the apps I manage. I also saw this tweet - https://twitter.com/testflyjets/status/1102410441723015168 - so I don't think these are targeted attacks, but rather ...
user avatar
3 votes
Accepted

How secure is pgAdmin to save database password?

The pgAdmin maintainers adopted a suggestion of mine and now the stored passwords have a master password to encrypt them.
user avatar
3 votes
Accepted

If Postgres trusts localhost connections, is it dangerous to visit random websites?

You basically rely on the strictness of the PostgreSQL protocol parser. In the past there were several attacks where too much tolerance against malformed input made attacks from the browser possible, ...
user avatar
3 votes

Does "row-level security" actually serve a security purpose?

It works by introducing additional WHERE clauses in SQL statements attributing the query to a particular user / tenant / domain. ... the application is of course free to misattribute the user. This ...
user avatar
2 votes

Is Postgres password-based authentication secure?

Please, have a look at this TCP Stream capture to a Postgres server from a client application (C# with Npgsql connector): There, you can see the md5 hash from password, username and salt (look at the ...
user avatar
  • 123
2 votes
Accepted

Ciphertext vs database level encryption

...does storing ciphertext in a database gain you much over using the database's built-in encryption? I would think it protect data that was obtained from SQL injection or database access as long as ...
user avatar
  • 4,783
2 votes
Accepted

How many combinations of md5sums can be computed from a call to random() in PostgreSQL?

random() can have at most 64 bits of significance, since it's a double precision float. That assumes perfect random number generation and all that. We only produce a random significand, the sign and ...
user avatar
2 votes

Metasploit Search Multiple Keywords

Inside an older version of msfconsole, you could call grep immediately before calling the search command. For example, to search for the 2 terms 'shellshock' and 'mod_cgi': msf > grep mod_cgi ...
user avatar
2 votes

Can TLS be a secure alternative to VPN?

Yes, it's a perfectly reasonable option. It's what AWS RDS, Heroku Postgres, etc does. Like any software PostgreSQL could have pre-authentication remote exploits. You should keep up to date on ...
user avatar
2 votes

Postgres password security

Pg stores its passwords in pg_authid Password (possibly encrypted); null if none. If the password is encrypted, this column will begin with the string md5 followed by a 32-character hexadecimal MD5 ...
user avatar
  • 2,287
2 votes

What logs to look for on Ubuntu when Postgres DB is hacked!

That Warning is irrelevant - The attack itself could have been through any weakness you have on your network, or through a phish, or a web facing service or anything. You need to pull all your logs ...
user avatar
  • 61.4k
2 votes
Accepted

Heroku postgres: potential brute force attack

Almost certainly not. It's quite common to see automated attacks from web scanners - IPv4 is a pretty small address space and quite easy to enumerate (IPv6, at least, makes them work a bit to find ...
user avatar
2 votes

How strong should a database password be?

So I'm simply asking, how strong would my (super user) database credentials ideally be? Maximum strength. Based on this answer, a length 100 cryptographically random password with upper, lower, ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible