SQLFury - An SQL injection scanner, using blind SQL injection techniques to extract information from a target database

SQL Injection Scanner:

An SQL injection scanner, using blind SQL injection techniques to extract information from a target database. 

Database Support:

MySQL

PostgreSQL

Oracle

Microsoft SQL Server

Extract from database:

Database version.

Current database user.

All database users.

Database name.

All database names.

All table names.

All columns names.

Entire columns.

Blocking Users by IP

One of the things I like about MySQL is the built-in control over what hosts/IP addresses are allowed to connect into the server. This is granular down to the user (equivalent to SQL Server's login/server principal).

Unfortunately, SQL Server doesn't have the same capabilities with respect to specifying what IPs or hosts a login can come in from, at least nothing built-in that's as clear and simple as with MySQL. I'd like to see something similar to the way MySQL handles it. But until then, there is a way to do this using logon triggers which some folks have hit upon. If you're not familiar with logon triggers, they are similar to DDL triggers, except they fire on a logon event (such as when someone connects to SQL Server). They were quietly introduced in SQL Server 2005 SP2, and they give us the ability to rollback a connection, thereby effectively terminating it. If you're still supporting SQL Server 2000 or below servers, you'll have to use another means to control connections.

Planning for Hyper-V Security

Once you have updated the Windows Server® 2008 operating system with the Hyper-V™ technology release bits and enabled the Hyper-V role, you are ready to run virtual machines (VMs) on your server, now called a virtualization server (also called a “host”).

How does this change your security? Not much. Hyper-V is designed to be fairly transparent. You secure your VMs the same way that you secure physical machines. For example, if you run antivirus software on the physical machine, run it on the VM (not the host). If you segment the physical server to a particular network, do the same to the VM.

Securing the virtualization server itself involves all the measures you take to safeguard any Windows Server 2008 server role, plus a few extra to help secure the VMs, configuration files, and data. 

Windows Server 2008 Hyper-V Security Guide – beta now available

For organizations that seek cost-effective operations, the benefits of virtualization are more evident than ever. Microsoft® Hyper-V technology allows consolidation of workloads that are currently spread across multiple underutilized servers onto a smaller number of servers. This capability provides you with a way to reduce costs through lower hardware, energy, and management overhead while creating a more dynamic IT infrastructure.

Virtualization technologies are causing enterprise organizations to shift their thinking about IT. The Hyper-V Security Guide can help you elevate the security of virtualized Windows Server® environments to meet your business-critical needs. This accelerator provides IT professionals like you with recommendations to address your key security concerns around server virtualization. The guide provides authoritative guidance that relates to the following strategies for securing virtualized environments.