MSSQL:
Enumeration
Enumerate MSSQL using nmap, nxc, and impacket for DB info
1 guide
•
Created Dec 28, 2025
•
Updated Mar 29, 2026
MSSQL enumeration with nmap and netexec
Enumerate MSSQL instances using Nmap scripts and NetExec to identify versions, configurations, linked servers, and credentials.
MSSQL enumeration starts with instance discovery through the SQL Server Browser service on UDP 1434 or direct connection to TCP 1433. Named instances, version info, and service accounts reveal the attack surface.
Once connected, enumerate databases, schemas, users, roles, and linked servers. Linked server mappings are especially valuable since they expose trust relationships that can be abused for lateral movement across the environment.