Microsoft SQL Attacks
Regardless of their size or type, all organizations inevitably use databases
both for data analysis and application data storage.
Because they are so ubiquitous, and often contain high value data,
databases are excellent targets during a penetration test.
In this module, we will focus on Microsoft SQL (MS SQL)
and how it can be leveraged during a penetration test
to compromise Windows servers
and obtain additional access within an organization.
We'll focus primarily on MS SQL
because it is typically integrated with Active Directory
Nevertheless, the concepts used in this module may also be applicable
to SQL databases from other vendors.
We'll investigate a variety of MS SQL attack vectors such as enumeration,
authentication,
privilege escalation,
and remote code execution.