skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-mssql

Tests Microsoft SQL Server instances for weak credentials, xp_cmdshell execution, and NTLM relay attack paths.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#database security#MSSQL#Active Directory#NTLM relay#xp_cmdshell#linked servers
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-mssql
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-mssql
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-mssql
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-mssql

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, Microsoft SQL Server instances often expose weak SA credentials, enabled xp_cmdshell, linked servers, and NTLM coercion paths that manual testing can miss. This Skill provides a structured methodology to enumerate, exploit, and document MSSQL attack surfaces with concrete confirmation steps.

Core Features & Use Cases

  • Enumeration and Authentication: Discover instances via nmap NSE scripts and Metasploit, then authenticate with impacket-mssqlclient, sqsh, netexec, or brute-force tools like Hydra and MSSqlPwner.
  • Exploitation Primitives: Enable xp_cmdshell for OS command execution, coerce NTLM hashes via xp_dirtree for capture or relay, read files with OPENROWSET BULK, and write webshells through Ole Automation Procedures.
  • Lateral Movement: Pivot through linked servers with EXEC (...) AT [LINK], escalate from db_owner to sysadmin, and leverage MSSQLSvc SPN silver tickets.
  • Use Case: A tester finds port 1433 open on an internal host, connects with empty sa credentials, confirms sysadmin membership, enables xp_cmdshell, and documents full OS command execution as the SQL service account in a structured finding report.

Quick Start

Use the pentesting-mssql skill to enumerate and test the SQL Server instance at the target IP for weak credentials and xp_cmdshell execution.

Frequently Asked Questions about pentesting-mssql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test MSSQL for weak or empty SA passwords?▼

Test for empty SA passwords using nmap with the ms-sql-empty-password script or by connecting with impacket-mssqlclient sa:@<IP>. You can also brute force credentials with Hydra, netexec, or MSSqlPwner, but limit attempts to avoid account lockouts.

How to enable xp_cmdshell on Microsoft SQL Server for command execution?▼

Enable xp_cmdshell by first confirming sysadmin membership with SELECT IS_SRVROLEMEMBER('sysadmin'), then run sp_configure 'show advanced options',1 and sp_configure 'xp_cmdshell',1 with RECONFIGURE. Execute commands with EXEC master..xp_cmdshell 'whoami' as the SQL service account.

What tools work best for MSSQL penetration testing?▼

impacket-mssqlclient handles authentication, linked-server enumeration, and xp_cmdshell execution, while nmap NSE scripts cover unauthenticated discovery. Metasploit, netexec, and MSSqlPwner add brute force, NTLM relay, and CLR assembly execution capabilities.

Does xp_cmdshell work on Amazon RDS or managed SQL Server?▼

No, managed database services like Amazon RDS disable xp_cmdshell and the TRUSTWORTHY setting. On these platforms, shift focus to application-layer attacks and data exfiltration rather than OS command execution.

How do I capture NTLM hashes from a SQL Server?▼

Force the SQL service account to authenticate to your host by running xp_dirtree, xp_subdirs, or xp_fileexist against a UNC path while Responder or impacket-smbserver listens. The captured NetNTLMv2 hash can be cracked with Hashcat mode 5600 or relayed.

What are the limitations of linked-server lateral movement in MSSQL?▼

Linked-server exploitation only yields remote code execution when the linked login maps to a sysadmin on the remote instance. Check mappings with sp_linkedservers and sp_helplinkedsrvlogin, then verify privileges by running IS_SRVROLEMEMBER through EXEC (...) AT [LINK].

Related Skills

Explore More Software Engineering Skills→
duriandurinoduriandurino

enum

Discover live hosts and enumerate open ports and services with nmap, gobuster, feroxbuster, and ffuf.

Community
Intermediate
zangxin75zangxin75

security-reviewer

Conduct security audits and code vulnerability reviews with SAST scans.

Community
Advanced
davila7davila7
30.5k

Active Directory Attacks

Executes Active Directory penetration testing techniques including Kerberoasting, DCSync, and NTLM relay attacks.

Community
Advanced
DCx7C5DCx7C5

metasploit-SKILL.md

Validate scanner findings by confirming exploitability with Metasploit Framework.

Community
Advanced