SQL的密码管理的六个危险判断_MySQL
bitsCN.com
当管理SQL Server内在的帐户和密码时，我们很容易认为这一切都相当的安全。但实际上并非如此。在这里，我们列出了一些对于SQL Server密码来说非常危险的判断。
当管理SQL Server内在的帐户和密码时，我们很容易认为这一切都相当的安全。毕竟，你的SQL Server系统被保护在防火墙里，而且还有Windows身份验证的保护，所有用户都需要密码才能进入。这听起来非常的安全，特别是当你认为所有人都这么做的时候。可实际上，它并不像我们想象得那么安全。
在这里，我们列出了一些对于SQL Server密码来说非常危险的判断：
密码测试无需计划
当进行测试时，直接就开始尝试破解密码将是一个很大的错误。无论你是在本地还是通过互联网进行测试，我都强烈建议你获得权限，并建议一个帐户被锁定后的回滚方案。最后你要做的就是确保在账户被锁定时，数据库用户无法进行操作，而且与之相连的应用程序也将无法正常运行。
通过互联网，密码仍然是安全的
对于通过混合方式实现的SQL Server，你可以很容易的通过一些分析软件(比如OmniPeek、Ethereal)立刻从网上抓到它的密码。同时，Cain and Abel可以用来抓取基于TDS的密码。你可能以为通过内网交换机就可以避免这一问题?然而，Cain的ARP中毒路由功能就可以很轻松的破解它。在大约一分钟之内，这个免费软件就可以攻破你的交换机，并看到本地网络的内部数据交换，从而帮助其它软件更容易的抓取密码。
事实上，问题并没有就此结束。有些误解认为在SQL Server中使用Windows身份验证是很安全的。然而，事实并非如此。上述软件同样可以迅速的从网上抓到Windows、Web、电子邮件等相关的密码，从而获得SQL Server的访问权限。
通过使用密码政策，我们就可以不用测试密码
无论你的密码政策有多严厉，却总会有一些办法可以绕开它。比如现在有一个未进行配置的服务器、一个Windows域外的主机、一个未知的SQL Server或者一些特殊的工具，它们可以破解最强壮的密码。这些东西就可以利用你密码的弱点并是你的代码政策变得无效
另外，同样重要的是，有些测试结果可能会说由于你的密码已经非常强壮，你的数据库很安全，但你千万不要轻信。一定要自己在测试并验证一下，密码缺陷是否还在。尽管你可能会觉得一切都很好，但实际上你可能落掉了一些东西。
既然SQL Server密码是不可重获的，那如果我知道他很强壮、很安全，我有为什么要破解他呢?
事实上，SQL Server的密码是可以重获的。在SQL Server 7和SQL Server 2000中，你可以使用像Cain and Abel或者收费的NGSSQLCrack这种工具来获得密码哈希表，而后通过暴力对其破解进行攻击。这些工具使你可以对SQL Server密码SHA哈希表进行反向工程。尽管破解的结果并不能够保证，但它确实是SQL Server的一个弱点。
我使用MBSA检查过SQL Server密码的缺陷，并没有发现什么严重的问题
Microsoft Baseline Security Analyzer是一个用来根除SQL Server弱点的工具，但他并不完善，特别是在密码破解方面。对于深层的SQL Server和Windows密码破解，我们需要使用第三方软件，如免费的SQLat和SQLninja(可以在SQLPing 3中找到)和Windows密码破解工具，如ElcomSoft's Proactive Password Auditor和Ophcrack。
此外，使用在SQL Server中使用Windows身份验证并不表示你的密码就是安全的。一些人只要了解如何破解Windows密码，在花一些时间，就可以破解你的密码并控制整个网络。特别是，如果他们使用Ophcrack's LiveCD来攻击一个物理上不安全的Windows主机，比如笔记本电脑或者易可达的服务器，那将变得
bitsCN.com
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
Solution: Your organization requires you to change your PIN
Oct 04, 2023 pm 05:45 PM
The message "Your organization has asked you to change your PIN" will appear on the login screen. This happens when the PIN expiration limit is reached on a computer using organization-based account settings, where they have control over personal devices. However, if you set up Windows using a personal account, the error message should ideally not appear. Although this is not always the case. Most users who encounter errors report using their personal accounts. Why does my organization ask me to change my PIN on Windows 11? It's possible that your account is associated with an organization, and your primary approach should be to verify this. Contacting your domain administrator can help! Additionally, misconfigured local policy settings or incorrect registry keys can cause errors. Right now
Local users and groups are missing on Windows 11: How to add it
Sep 22, 2023 am 08:41 AM
The Local Users and Groups utility is built into Computer Management and can be accessed from the console or independently. However, some users find that local users and groups are missing in Windows 11. For some people who have access to it, the message suggests that this snap-in may not work with this version of Windows 10. To manage user accounts for this computer, use the User Accounts tool in Control Panel. The issue has been reported in previous iterations of Windows 10 and is usually caused by issues or oversights on the user's side. Why are local users and groups missing in Windows 11? You are running Windows Home edition, local users and groups are available on Professional edition and above. Activity
How to solve the problem that Windows 11 prompts you to enter the administrator username and password to continue?
Apr 11, 2024 am 09:10 AM
When using Win11 system, sometimes you will encounter a prompt that requires you to enter the administrator username and password. This article will discuss how to deal with this situation. Method 1: 1. Click [Windows Logo], then press [Shift+Restart] to enter safe mode; or enter safe mode this way: click the Start menu and select Settings. Select "Update and Security"; select "Restart Now" in "Recovery"; after restarting and entering the options, select - Troubleshoot - Advanced Options - Startup Settings -&mdash
How to set router WiFi password using mobile phone (using mobile phone as tool)
Apr 24, 2024 pm 06:04 PM
Wireless networks have become an indispensable part of people's lives in today's digital world. Protecting the security of personal wireless networks is particularly important, however. Setting a strong password is key to ensuring that your WiFi network cannot be hacked by others. To ensure your network security, this article will introduce in detail how to use your mobile phone to change the router WiFi password. 1. Open the router management page - Open the router management page in the mobile browser and enter the router's default IP address. 2. Enter the administrator username and password - To gain access, enter the correct administrator username and password in the login page. 3. Navigate to the wireless settings page - find and click to enter the wireless settings page, in the router management page. 4. Find the current Wi
Tutorial on changing wifi password on mobile phone (simple operation)
Apr 26, 2024 pm 06:25 PM
Wireless networks have become an indispensable part of our lives with the rapid development of the Internet. In order to protect personal information and network security, it is very important to change your wifi password regularly, however. To help you better protect your home network security, this article will introduce you to a detailed tutorial on how to use your mobile phone to change your WiFi password. 1. Understand the importance of WiFi passwords. WiFi passwords are the first line of defense to protect personal information and network security. In the Internet age, understanding its importance can better understand why passwords need to be changed regularly. 2. Confirm that the phone is connected to wifi. First, make sure that the phone is connected to the wifi network whose password you want to change before changing the wifi password. 3. Open the phone’s settings menu and enter the phone’s settings menu.
Incorrect password, beware BitLocker warning
Mar 26, 2024 am 09:41 AM
This article will explore how to solve the problem of wrong password, especially the need to be careful when dealing with BitLocker warnings. This warning is triggered when an incorrect password is entered multiple times in BitLocker to unlock the drive. Usually, this warning occurs because the system has a policy that limits incorrect login attempts (usually three login attempts are allowed). In this case, the user will receive an appropriate warning message. The complete warning message is as follows: The password entered is incorrect. Please note that continuously entering incorrect passwords will cause the account to be locked. This is to protect the security of your data. If you need to unlock your account, you will need to use a BitLocker recovery key. The password is incorrect, beware the BitLocker warning you receive when you log in to your computer
How to Remove Windows 10 Lock Screen Password Now
Jan 09, 2024 pm 03:33 PM
After upgrading the win101909 system, some friends may want to cancel their computer lock screen password. If you don’t know what to do, I think we can find the account options in the computer’s settings window. Let’s take a look at the specific methods. How to cancel the lock screen password in win101909: 1. First press Win+I to open the settings interface. 2. Then find the account--login option, and then set it as shown. How to cancel power-on password login in win101909: 1. Execute regedit during running to open the registry and navigate to the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu
How to use Passkey for your Microsoft account
Feb 19, 2024 am 11:03 AM
Passkey is a more advanced and secure way to log in and can be used with a Microsoft account. This article will guide you how to use Passkey in your Microsoft account, introduce its advantages and the differences with passwords. Before we get into the details, we emphasize that if you frequently forget your passwords or need to log in quickly, Passkey will generally be better for you. What is Passkey? How are they different from passwords? Passwords are an advanced and secure authentication method that can replace traditional password logins. Each application has a unique key, ensuring security and preventing threats like phishing. Users can confirm their identity via email and password, or use facial recognition, fingerprint or security key
