Wrapping Up
In this module, we presented multiple techniques to attack
and compromise a Microsoft SQL server in a domain setting.
Most of the techniques also apply to SQL injection vulnerabilities.
As such, it may be possible to compromise multiple SQL servers
deep in the internal network
directly from a perimeter web server
if insecure permissions
and SQL server links exist.
This module focused exclusively on Microsoft SQL
due to its common authentication integration with Active Directory,
but other database types such as Oracle and MySQL
can have similar misconfigurations.
It’s also possible to find SQL links between databases of different types.