> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/utility/service/mssql-1433-2433.md).

# MSSQL (1433-2433)

Microsoft SQL Server.

<details>

<summary>Protocol Information</summary>

Microsoft SQL Server is a relational database management system developed by Microsoft.

</details>

## Port

<table data-header-hidden><thead><tr><th width="166">Port</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:green;"><strong>1433</strong></mark><strong> TCP</strong></td><td>MSSQL</td></tr><tr><td><mark style="color:green;"><strong>2433</strong></mark><strong> TCP</strong></td><td>MSSQL</td></tr></tbody></table>

## Interact

You can check if it is possible to log in with user `“root”` and password `“”`.

<table><thead><tr><th width="206">Tools</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/fortra/impacket/blob/master/examples/mssqlclient.py">impacket-mssqlclient</a></td><td><code>mssqlclient.py [&#x3C;DOMAIN>/]&#x3C;USER>@&#x3C;IP> -windows-auth</code></td></tr><tr><td>sqsh</td><td>From Windows <em>(After queries type GO on new line)</em><br><code>sqsh -S &#x3C;IP> -U &#x3C;USER> -P &#x3C;PASSWORD></code></td></tr><tr><td>sqlcmd</td><td>From Windows <em>(After queries type GO on new line)</em><br><code>sqlcmd -S &#x3C;IP> -U &#x3C;USER> -P &#x3C;PASSWORD></code></td></tr><tr><td><a href="https://github.com/NetSPI/PowerUpSQL">PowerUpSQL</a></td><td>From Windows (<a href="https://github.com/NetSPI/PowerUpSQL/wiki/PowerUpSQL-Cheat-Sheet">Cheat-Sheet</a>)<br><code>Import-Module .\PowerUpSQL.ps1</code> <br><code>Get-SQLInstanceDomain</code> <br><code>Get-SQLQuery -Verbose -Instance "&#x3C;IP>,&#x3C;PORT>" -username "&#x3C;DOMAIN>\&#x3C;USER>" -password "&#x3C;PASS>" -query 'Select @@version'</code></td></tr></tbody></table>

Or [Connect with dbeaver](https://www.youtube.com/watch?v=PeuWmz8S6G8\&ab_channel=JulioUre%C3%B1a%28plaintext%29).

```
> select name from sys.databases
> use <DB_NAME>
> SELECT * FROM information_schema.tables;
> SELECT * from <TABLE>;
> SELECT * FROM sys.objects;   # sysusers 
```

## Attacks

* [SQLi and more with MSSQL](/rednote/pentesting-process/web-attacks/sqli.md#mssql)