Collaborate Disseminate
Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems remain. I have tried scanning with sqlnin… Continue reading Are there any tools for scanning for SQL injection vulnerabilities while logged in?
I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let’s take a look at this PHP code which uses regular expressions instead of the builtin PH… Continue reading SQL injection using letters and numbers?
I created an online store for a friend of mine.
I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The email includes details abou… Continue reading A customers site had a big mysql injection attack on it, just want to learn from it
I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the address bar, nothing happen… Continue reading SQL Injection: Drop All Tables
It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app:
<VirtualHost ilia.ws>
Include /home/ilia/sql.cnf
</VirtualHost>
then declare your par… Continue reading Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?
Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time?
Im trying to detect brute force attempts.
Is there a way to setup a… Continue reading mysql security logging
AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how MySQL handle longer or shorter keys? I found out that PyCrypto for instances recomend to transform the key by using MD5, SHA-1, SHA-2, etc. hashes and then usin… Continue reading MySQL AES_ENCRYPT key length
Following the hardening theme….
What are some best practices, recommendations, required reading for securing MySQL.