Scanning MSSQL servers with Metasploit

Let us now jump into Metasploit-specific modules for testing the MSSQL server and see what kind of information we can gain by using them.

Using the mssql_ping module

The very first auxiliary module that we will be using is mssql_ping. This module will gather service information related to the MSSQL server.

So, let us load the module and start the scanning process as follows:

We can clearly see that mssql_ping has generated an excellent output of the fingerprinted MSSQL service.

Brute-forcing MSSQL passwords

Metasploit also offers brute-force modules. A successful brute-force does exploit low entropy vulnerabilities; if it produces results in a reasonable amount of time it is considered a valid finding. Hence, we will cover brute-forcing in this phase of the penetration test itself. Metasploit has a built-in module named mssql_login, which we can use as an authentication tester for brute-forcing the username and password of an MSSQL server database.

Let us...