Blindly Discover SQL Server Instances with PowerUpSQL

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

Any domain user can query AD SPN records to enumerate every SQL Server—instances and ports included—without noisy scans; NetSPI's Get-SQLServerAccess module then tests each for accessible logins.

Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.

Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.

Introduces the PowerUpSQL PowerShell module for SQL Server instance discovery, weak configuration auditing, and privilege escalation at scale, with multiple loading options for testers and admins.

Thomas Elling demonstrates querying Active Directory through SQL Server's OLE DB ADSI provider with OPENQUERY and OPENROWSET, adding new PowerUpSQL functions that automate AD recon from SQL servers.