Data
The database where the application keeps its records.
What It Is
The data layer is where applications keep their records. It holds databases such as SQL Server, MySQL, PostgreSQL and MongoDB, and fast stores such as Redis. It also holds what attackers are usually after, such as customer details, documents, credentials and payment records.
It sits beside the stack rather than in it because nothing runs on a database. The application reaches it over the network, often on another server, through a database account. The database needs its own operating system and hardware beneath it, just like the app.
So there are two ways to its records. One is straight in, through a flaw or a weak account in the database itself. The other is sideways, through the application and its database account, which is the route SQL injection takes.
- App
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
On This Layer
These are the technologies on the Data layer that this topic covers. Open one to see what it runs on, how to spot it and what a flaw in it reaches.
How Far a Flaw Reaches
A flaw or weak account in a database exposes the records it holds, but nothing runs on it, so the flaw does not reach the app's code. Some databases can run commands on their own server, so a database account with too much power can become a way onto the machine.