Skip to content
HackIndex.io

MSSQL:

Post-Exploitation

Pillage DBs, dump password hashes, and loot stored credentials

2 guides • Created Dec 28, 2025 • Updated May 15, 2026
2 guides

MSSQL Credential Dump

Techniques for extracting credentials from MSSQL databases post-compromise, including sa accounts, linked server passwords, and stored connection strings.

May 15, 2026 • 4 min read

MSSQL Database Pillaging

Techniques for extracting credentials, data, and secrets from compromised MSSQL instances, including linked servers, agent jobs, and stored procedures.

May 15, 2026 • 4 min read

MSSQL post-exploitation focuses on extracting credentials and sensitive data from a compromised instance. System tables store password hashes, and application databases often contain plaintext credentials, API keys, and connection strings.

SQL Server Agent jobs may contain scheduled commands and stored credentials. Reviewing job history, linked server passwords, and database mail configurations reveals additional accounts and lateral movement paths across the environment.