Finding Weak Passwords for Domain SQL Servers on Scale using PowerUpSQL

Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

Introduces the PowerUpSQL PowerShell module for SQL Server instance discovery, weak configuration auditing, and privilege escalation at scale, with multiple loading options for testers and admins.

Thomas Elling demonstrates querying Active Directory through SQL Server's OLE DB ADSI provider with OPENQUERY and OPENROWSET, adding new PowerUpSQL functions that automate AD recon from SQL servers.

Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.

Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.