Penetration testers often need to check that no administrative account has a weak password. With some help from Nmap NSE, we can easily check that an MS SQL instance has a system administrator (sa
) account with an empty password.
This recipe teaches us how to use Nmap to find MS SQL servers with an empty system administrator password.
To find MS SQL servers with an empty sa
account, open your terminal and enter the following Nmap command:
$ nmap -p1433 --script ms-sql-empty-password -v <target>
If an account with an empty password is found, it will be included in the script output section:
PORT STATE SERVICE 1433/tcp open ms-sql-s | ms-sql-empty-password: | [192.168.1.102:1433] |_ sa:<empty> => Login Success