Perform Enumeration Of Mssql With Metasploit: Complete Guide

Have you ever wondered how a red‑team tester quietly talks to a hidden SQL server without tripping the alarms?
It’s not magic. It’s a mix of port scans, banner grabs, and a handful of Metasploit modules that can turn a silent database into a goldmine of credentials. If you’re new to the scene—or just want a refresher—this post is your one‑stop shop for enumerating MSSQL with Metasploit But it adds up..

What Is MSSQL Enumeration With Metasploit

Enumeration is the act of probing a target to learn what’s there: which services are running, what versions they’re on, what users exist, and what privileges those users have. With MSSQL, that means discovering databases, tables, stored procedures, and often, the dreaded “sa” password or other credential leaks.

Metasploit is a penetration‑testing framework that bundles a huge library of exploits, scanners, and auxiliary modules. When you pair it with MSSQL‑specific tools, you can automate the whole discovery process, from finding the server to pulling out the secrets it hides.

Why It Matters / Why People Care

Picture this: a corporate network with dozens of Windows servers, each running a hidden MSSQL instance. Worth adding: the database holds customer data, HR records, and financials. If an attacker can enumerate the instance and lift a password, they can pivot to other machines, exfiltrate data, or plant ransomware.

The short version is: the more you know about the database, the easier it is to break into it.

In practice, most organizations patch the operating system but forget about the database layer. Metasploit gives you a low‑cost, repeatable way to expose that blind spot Easy to understand, harder to ignore. Less friction, more output..

How It Works (or How to Do It)

Below is a step‑by‑step walk‑through of a typical MSSQL enumeration workflow in Metasploit. I’ll sprinkle in some tips that save time and avoid the usual pitfalls.

1. Prepare Your Environment

• Metasploit installation: If you’re on Kali, it comes pre‑installed. On Windows, download the latest installer from Rapid7.
• Target IP: Know the IP address or hostname of the machine you’re probing.
• Network access: Ensure you can reach the target on the MSSQL port (default 1433). A quick nmap -sV -p 1433 target is a good sanity check.

2. Start Metasploit

msfconsole

Once inside, set your RHOST (remote host) and RPORT (remote port) variables:

set RHOST 10.0.0.42
set RPORT 1433

3. Use the MSSQL Auxiliary Scanner

Metasploit has a built‑in scanner that grabs the banner and checks for known vulnerabilities Simple, but easy to overlook..

search type:auxiliary name:mssql
use auxiliary/scanner/mssql/mssql_version
run

The output will show you the SQL Server version and build number—critical for selecting the right exploit later.

4. Enumerate Databases

Once you know the server’s version, switch to the enumeration module:

use auxiliary/scanner/mssql/mssql_enum
set USERNAME sa
set PASSWORD ''
run

If you don’t have credentials, the module can try an unauthenticated walk‑through (if the server allows it). The output lists:

• Databases (master, model, msdb, etc.)
• For each database: tables, stored procedures, and users

5. Gather User Information

Knowing which users exist is the first step to credential harvesting Turns out it matters..

use auxiliary/scanner/mssql/mssql_user
run

You’ll get a list of SQL logins. Pay special attention to those with sysadmin rights Easy to understand, harder to ignore..

6. Password Policy and Brute‑Force

If you find a weak or default password, you can brute‑force it with:

use auxiliary/scanner/mssql/mssql_login
set USERNAME sa
set PASSWORD_FILE /usr/share/wordlists/rockyou.txt
run

The module will try each password until it succeeds or exhausts the list Most people skip this — try not to. Practical, not theoretical..

7. Dump Database Credentials

Some databases store credentials in tables or encrypted blobs. The mssql_enum module can surface them if they’re stored in plain text.

Alternatively, use the mssql_enum module’s -o option to export data to a CSV for easy analysis:

set OUTPUT_FILE credentials.csv
run

8. Pivot to Other Machines

If you’ve gained a sysadmin login, you can run the ms_sql_cmd module to execute arbitrary commands on the server:

use auxiliary/admin/mssql/mssql_cmd
set PASSWORD 
run

From here, you can list user accounts on the host, read the registry, or even launch a reverse shell.

Common Mistakes / What Most People Get Wrong

1. Assuming the default port is always 1433
   Many MSSQL instances run on non‑standard ports. An nmap -p- scan can reveal hidden services Most people skip this — try not to..

2. Ignoring authentication
   Some teams disable authentication for local connections. Don’t miss the chance to try sa with no password or the sa with a blank password.

3. Skipping version checks
   An old SQL Server build might have a known exploit that’s easier than brute‑forcing.

4. Overlooking stored procedures
   Stored procedures can contain hard‑coded passwords or backdoors. The enumeration module surfaces them, but you still need to read their code Which is the point..

5. Assuming success means full control
   Even a successful login often only gives you limited privileges. Always check the effective permissions Surprisingly effective..

Practical Tips / What Actually Works

• Cache the banner: Store the output of mssql_version in a file. It saves time if you run multiple scans against the same host.
• Use the -d flag: Many modules support a debug mode that prints every request. Handy when the server is picky.
• Combine with PowerShell: If you have a Windows host you can’t reach with Metasploit, use PowerShell to run sqlcmd and pipe the output back to your Kali box.
• Automate with a script: Wrap the module calls in a Bash or Ruby script to enumerate a subnet in minutes.
• Check the sys.dm_exec_connections view: It reveals active connections and can hint at other services.
• Respect the law: Never run these tests on a system you don’t have explicit permission to probe.

FAQ

Q: Can I enumerate MSSQL on a cloud instance without credentials?
A: If the instance is publicly exposed and allows unauthenticated access, the mssql_enum module will pull what it can. Otherwise, you’ll need a valid login Most people skip this — try not to..

Q: What if the MSSQL instance is encrypted with TLS?
A: Metasploit supports the -ssl option. Just add set SSL true before running the scanner The details matter here. No workaround needed..

Q: How do I avoid detection by an IDS?
A: Slow down your scans, use --delay and --threads options. Also consider tunneling traffic through a VPN or a bastion host.

Q: Is there a way to get the password hash instead of the clear text?
A: Yes, the mssql_enum module will list password hashes if they’re stored in the sys.sql_logins view. You can then crack them with tools like John the Ripper.

Q: Can Metasploit enumerate MySQL or PostgreSQL?
A: Absolutely. The framework has analogous modules for those databases. Just search for type:auxiliary name:mysql or name:postgresql Turns out it matters..

Closing

Enumerating MSSQL with Metasploit is a powerful skill that turns a silent database into an open book. In practice, remember: the goal isn’t just to break in; it’s to understand what you’re dealing with so you can harden the system before the next attack. By following the steps above, you’ll uncover user accounts, passwords, and hidden data that could be the key to a deeper compromise. Happy hunting!