---
id: 8247
title: "Locate and Attack Domain SQL Servers without Scanning"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/network-pentesting/locate-and-attack-domain-sql-servers-without-scanning/"
published_at: "2014-05-28T00:00:00Z"
tags: ["active-directory", "reconnaissance", "powershell", "discovery", "spn", "sql-server"]
phying_url: "https://phying.com/item/8247"
lang: en
---

# Locate and Attack Domain SQL Servers without Scanning

## Summary

Any domain user can query AD SPN records to enumerate every SQL Server—instances and ports included—without noisy scans; NetSPI's Get-SQLServerAccess module then tests each for accessible logins.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2014-05-28T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/network-pentesting/locate-and-attack-domain-sql-servers-without-scanning/
- **Phying News:** https://phying.com/item/8247