MSSQL:

Enumeration

Enumerate MSSQL using nmap, nxc, and impacket for DB info

1 guide • Created Dec 28, 2025 • Updated Mar 29, 2026

1 guide

MSSQL enumeration with nmap and netexec

Enumerate MSSQL instances using Nmap scripts and NetExec to identify versions, configurations, linked servers, and credentials.

Jan 18, 2026 • 4 min read

MSSQL enumeration starts with instance discovery through the SQL Server Browser service on UDP 1434 or direct connection to TCP 1433. Named instances, version info, and service accounts reveal the attack surface.

Once connected, enumerate databases, schemas, users, roles, and linked servers. Linked server mappings are especially valuable since they expose trust relationships that can be abused for lateral movement across the environment.