skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

mssql-pentesting

Tests MSSQL servers on port 1433 through enumeration, xp_cmdshell execution, and privilege escalation.

1.7k|238|Updated Dec 7, 2019
Search Tags:#penetration testing#database security#MSSQL#NTLM#Privilege escalation#xp_cmdshell#linked servers
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill mssql-pentesting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mssql-pentesting
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/exploit/network-service/mssql-pentesting
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill mssql-pentesting

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It gives security testers a structured, phase-by-phase methodology for assessing Microsoft SQL Server instances, replacing ad-hoc manual probing with a repeatable workflow from service discovery to post-exploitation.

Core Features & Use Cases

  • Full Attack-Chain Coverage: Guides testing through seven phases: service discovery, authentication testing, database enumeration, xp_cmdshell command execution, linked server abuse, privilege escalation, and NTLM hash capture.
  • Tool Command References: Provides ready-to-use commands for nmap, nxc, hydra, impacket mssqlclient.py, sqsh, MSSQLPwner, PowerUpSQL, and Metasploit modules.
  • Use Case: During an internal network assessment, a scan reveals port 1433 open on a Windows host. The tester follows the decision trees to test default sa credentials, enumerate databases and permissions, enable xp_cmdshell for OS command execution, and pivot through linked servers to reach other database instances.

Quick Start

Ask the agent to assess the MSSQL service on a target host with port 1433 open, starting from service discovery and credential testing.

Frequently Asked Questions about mssql-pentesting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test MSSQL server security on port 1433?▼

Start with nmap MSSQL scripts to fingerprint the version and check for empty sa passwords, then test default credentials with netexec or hydra. After gaining access, enumerate databases, roles, and permissions before attempting command execution through xp_cmdshell.

How to enable xp_cmdshell on MSSQL for command execution?▼

Enable it with sp_configure by first setting 'show advanced options' to 1, then setting 'xp_cmdshell' to 1, each followed by RECONFIGURE. This requires sysadmin privileges; if blocked by keyword filters, invoke it indirectly through a variable.

What tools work for MSSQL penetration testing?▼

Common tools include impacket's mssqlclient.py for interactive access, netexec for authentication testing and command execution, MSSQLPwner for linked server abuse, PowerUpSQL for domain discovery, and Metasploit modules for enumeration and escalation.

Can MSSQL linked servers be used for lateral movement?▼

Yes. Enumerate linked servers with sp_linkedservers or sys.servers, then execute queries on remote instances via OPENQUERY or EXEC AT. If the link maps to a high-privilege login, you can enable xp_cmdshell on the remote server and chain across multiple hops.

Why does xp_cmdshell fail even with sysadmin access?▼

xp_cmdshell may be disabled by configuration, blocked by keyword filtering, or unavailable on DBaaS platforms like Azure SQL and RDS. Alternatives include OLE Automation, SQL Agent Jobs, CLR assemblies, or Python/R external scripts.

How does NTLM hash capture work through MSSQL?▼

Functions like xp_dirtree, xp_subdirs, and xp_fileexist force the SQL Server service account to authenticate to an attacker-controlled SMB share. Running Responder or impacket-smbserver captures the NetNTLMv2 hash, which can be cracked offline with hashcat mode 5600.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

recon-full

Enumerate subdomains, scan ports, fingerprint assets, and validate POCs.

Official
Advanced
ArianHobson333ArianHobson333
7

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

auth-coercion-relay

Automates PetitPotam, PrinterBug and DFSCoerce authentication coercion attacks with NTLM/Kerberos relay to SMB, LDAP, AD CS targets.

Official
Advanced
bpnrockstarbpnrockstar

hunt-nosqli

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and Redis.

Community
Advanced