OWASP AppSec – Database Trusts Presentation Video

Antti and I presented our revised version of "When Databases Attack" at the Secure360 conference in Minneapolis a few weeks ago.

Shares slides, Metasploit modules, and videos from the OWASP AppSec 2012 talk on abusing SQL Server trust relationships, misconfigurations, and weak defaults to reach high-value systems and data.

Antti Rantasaari and I will be delivering our presentation “Escalating Privileges through Database Trusts” at the National OWASP AppSec conference in Irvine, CA on September 10th.

Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.

Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.

Scott Sutherland shares scripts for finding sensitive data in SQL Server: a TSQL script sampling keyword-matching columns across databases, plus a Metasploit auxiliary module wrapping it.