Finding system administrator accounts with empty passwords in MS SQL servers
Penetration testers often need to check that no administrative account has a weak password. With some help from Nmap NSE, we can easily check that an MS SQL instance has a system administrator (sa
) account with an empty password.
This recipe teaches us how to use Nmap to find MS SQL servers with an empty system administrator password.
How to do it...
To find MS SQL servers with an empty sa
account, open your terminal and enter the following Nmap command:
$ nmap -p1433 --script ms-sql-empty-password -v <target>
If an account with an empty password is found, it will be included in the script output section:
PORT STATE SERVICE 1433/tcp open ms-sql-s | ms-sql-empty-password: | [192.168.1.102:1433] |_ sa:<empty> => Login Success
How it works...
The argument -p1433 --script ms-sql-empty-password
make Nmap initiate the NSE script ms-sql-empty-password
if an MS SQL server is found...