Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Attacking Application Specific SQL Server Instances

netspi.com | blog | #windows | #penetration-testing | #database-security | #sql-server | #powerupsql | #default-passwords

Summary

Shows how to find SQL Server instances bundled with third-party applications and test them against a default credential list, using PowerUpSQL functions for discovery and automated login attempts.
Published
Collected

original ↗

Related coverage

blog · netspi.com
SQL Server – Link….. Link….. Link….. and Shell: How to Hack Database Links in SQL Server!
Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.
blog · netspi.com
When Databases Attack – Finding Data on SQL Servers
Scott Sutherland shares scripts for finding sensitive data in SQL Server: a TSQL script sampling keyword-matching columns across databases, plus a Metasploit auxiliary module wrapping it.
blog · netspi.com
When Databases Attack: Hacking with the OSQL Utility
This blog will provide some examples that illustrate how the OSQL utility can be used to gain unauthorized access to systems, databases, and sensitive information.
blog · netspi.com
SQL Server Link Crawling with PowerUpSQL
Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.
blog · netspi.com
Establishing Registry Persistence via SQL Server with PowerUpSQL
Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.
blog · netspi.com
Get Windows Auto Login Passwords via SQL Server with PowerUpSQL
Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.
back