SQLRecon: Discover SQL/MSDE installations in the network

July 13, 2009 22:35 pm · 0 comments

by Black

in Penetration Testing,Security Reconnaissance

Now a days, all applications are web facing with most of them supporting a database. This inturn makes them vulnerable to attacks like SQL injections etc. After you have found a ‘suitable host’ what remains is that you know what database is the application (web) running. In such cases, you might want to try blind SQL techniques. This might get you into trouble as there are secure applications out there that will ban you after a certain number of attempts. SQLRecon will help you, to overcome this short coming.

It can perform both both active and passive scans of your network in order to identify all of the SQL Server/MSDE installations in your enterprise. It includes all known means of SQL Server/MSDE discovery into a single tool which can be used to discover servers on your network so you can properly secure them or let the administrator know about the same.

These are the features of SQLRecon:

  • Multi-threaded scanning engine
  • 6 Active scanning techniques
  • 2 Stealth scanning techniques
  • IP Range scanning
  • IP List scanning
  • Export results as XML or text file
  • Export IP list for use in future scans (i.e. Passive to Active)
  • ICMP check to increase scan speed
  • Debug mode to allow for greater scan visibility
  • Allows alternate credentials
  • Custom source port for UDP packets for firewall evasion

    • SQLRecon needs .NET Framework v1.1 to be installed on Microsoft Windows 2000, Windows XP or Windows 2003. It can also work withouth the .NET Framework. But, it is advisable that you use the .NET Framework version.

    A sample screenshot of SQLRecon:

    img1 SQLRecon: Discover SQL/MSDE installations in the network

    It can scan the network using the following techniques:

    • UDP (by probing UDP 1434)
    • REG (checking remote registry)
    • WMI: (initiating a WMI query)
    • TCP: (port scaning TCP 1433[default TCP port for SQL Server and MSDE]/2433 ['Hide server port']
    • SCM: (querying the service control manager)
    • SA: (access the SQL Server instance with a blank password)
    • BRO: (checking the browser service for SQL Server registration)
    • AD: (querying Active Directory for registered SQL Servers)

    Download the version that needs the .NET Framework & which does not need the .NET Framework.

    Related External Links

    • sqlninja – Blind SQL Injection Exploit Framework « RootSecurity
    Searches leading to this post:
    sqlrecon, scan network sql servers

    If you enjoyed this article, you might also like:

    Tagged as: , , , ,

    Comments on this entry are closed.

    Previous post:

    Next post: