114
votes
Accepted
Does read-only access to the database prevent sql injection?
No. You might be confusing SQL injection with data injection; read-only tables do not prevent SQL injection and at best do only a little to limit its impact.
SQL injection simply means the ability ...
- 72.4k
26
votes
Accepted
Sanitizing input for parameterized queries
No, it's not necessary. But please, read on.
Input sanitization is a horrible term that pretends you can wave a magic wand at data and make it "safe data". The problem is that the definition of "safe"...
- 898
17
votes
Accepted
Determine SSL/TLS version using Wireshark
(Adding a new answer which should be definitive, leaving the old around as it's useful debug for how we got here. Credit for pointing to the actual answer in comments goes to @P4cK3tHuNt3R and @...
- 72.4k
14
votes
Does read-only access to the database prevent sql injection?
No, trivial example
EXEC ('SELECT COUNT(*)
FROM table
WHERE UserName =''''' + @UserName + ''''' AND Password = '''''+@Password+'''''')
Set @Password to a' OR 1=1;--
And your ...
- 733
14
votes
Does read-only access to the database prevent sql injection?
Does a least-privilege (select ability on one table only), read-only connection to the database prevent all injection attacks?
SQL injection is a way for an attacker to modify an existing statement ...
- 191k
12
votes
Security risks of using SQL Server without a firewall
There are many vulnerabilities associated with database management systems. Basic security issues include:
Deployment security issues.
Application level (DBMS) security issues.
Abuse of database ...
- 670
9
votes
Accepted
AD User vs SQL User for SQL Server Authentication
Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL ...
- 35.6k
9
votes
Determine SSL/TLS version using Wireshark
I just use this filter in Wireshark to find TLS 1.0 traffic:
ssl.handshake.version==0x0301
0x0302 is TLS 1.1 and 0x0303 is TLS 1.2.
- 91
9
votes
Sanitizing input for parameterized queries
If I use fully parameterized queries everywhere, is it still necessary and/or security-relevant to somehow sanitize input?
Yes. It's always a good idea to sanitize the input before sending it to the ...
- 4,446
9
votes
Generating a PIN from cryptographic bytes
First of all, I totally agree with MechMK1 on the proper algorithm to generate cryptographically secure uniformly distributed random number between 0 and 10000. However:
there's no reason not to ...
- 1,759
8
votes
Accepted
Safest SQL database
TL;TR: these are not problems of the database. Maybe you are using a wrong architecture for your hidden service. And regarding the additional information after the edit of the question see at the end ...
- 191k
7
votes
Accepted
Does using ASP.NET prevent XSS
SQL Server does not prevent XSS. XSS would still be possible via issues in the web application code. Proper use of prepared statements with SQL Server can prevent SQLi, but to prevent XSS, you must ...
- 231
7
votes
This is a working SQL-injection. What could the server side query string look like?
In MySQL, the # symbol can be used as a comment marker. Quote marks in comments don't have to balance.
Not all SQL instances run on Microsoft databases.
- 33.9k
6
votes
Determine SSL/TLS version using Wireshark
(Ignore this answer, which I'm leaving for historical data, and read my other answer, which explains what's actually going on)
Update after an example packet was added to the question -
The packet ...
- 72.4k
6
votes
Accepted
Why Microsoft claims that SQL Server is the least vulnerable database?
When they say that, they are probably referring to the number of published exploits and vulnerabilities for their product. If true, this is a very, very bad idea.
I'm actually surprised it says that. ...
- 3,394
6
votes
Accepted
Security risks of using SQL Server without a firewall
First hoping that IP address control can add strong security is kind of a brave assumption. IP theft should always be considered as a possible attack.
Next, if there is no firewall at all in front of ...
- 26k
5
votes
What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?
Using SQLMap will be helpuf, since it scan for most well-known vulnerabilities and will save you some time and efford. But, the greatest threat is a hackers' imagination and ability to exploit ...
- 1,757
5
votes
Is internal or external hosting more secure?
In a generic sense neither internal nor external hosting are inherently more or less secure on their own. Ultimately it's just a different set of trade-offs.
In both situations the amount of security ...
- 14.1k
5
votes
Accepted
Why does this SQL injection have an equals symbol?
In SQL operator "AND" has higher precedence than "OR". Let add parentheses, to make the logic more clear:
SELECT * FROM Users WHERE (Name ="") or (""="&...
- 10.8k
4
votes
Accepted
SQL Injection via table name?
Yes. I'm assuming that you are building your query with string concatenation.
Let's take
SELECT * FROM [Database].[dbo].[#tableName#]
If you replace #tableName# by employee]; DELETE FROM [Database]...
- 6,951
4
votes
AD User vs SQL User for SQL Server Authentication
Using Active Directory for SQL Server has a number of advantages, which makes it the recommended approach. SQL DBAs will often want to have the database in Windows Integrated Authentication (WIA) mode ...
4
votes
How does the client pick the correct certificate from its certificate store?
The sever sends its certificate during the TLS handshake
and the client verifies its trust path.
In the first step the client matches the common name (CN) field with the server's hostname (it does ...
- 9,139
4
votes
Compromised server name and port number of a SQL Server DB Server
Sounds to me, that what was leaked is only information obtainable by a simple nmap scan.
If the security of your system depended on that staying private, you might have an issue in you approach ...
- 281
4
votes
Accepted
Can be SQL Queries sniffed through the client network adapter?
Unless the established connection between your software and the SQL server is encrypted by your software, then most likely the traffic can be intercepted and viewed using a network traffic analyzer ...
- 769
4
votes
What can I do with blind SQLi if the database is encrypted?
You already cracked half their defenses. Now all that's left is a compromise of the AES key. That should be a reason to worry. Especially because changing that key won't be trivial, because they would ...
- 49k
4
votes
Accepted
Giving different passwords to the app servers to access the same database. Pros and Cons?
A scenario with three different applications
If you have three different applications in most cases they should not all have full access to the database in the first place, just the data each needs. ...
- 636
4
votes
Accepted
How do I secure SQL passwords when distributing executables?
The moment you hardcore a password in your software, it's effectively exposed to anyone who can run and analyze this EXE file. It's a good idea to store it in a separate file and don't include this ...
- 306
3
votes
Are sqlcmd parameters inherently at risk of SQL injection?
If the attacker controls SQLCMD inputs, then they can do anything their login credentials (authorized or stolen) can do. That's just normal functioning.
Don't do this. This is a bad practice if ...
- 9,870
Only top scored, non community-wiki answers of a minimum length are eligible