Finding sysadmin accounts with empty passwords on MS SQL servers

Penetration testers often need to check that no administrative account has a weak password. With some help from Nmap NSE, we can easily check that no host (or hosts) has a sysadmin account with an empty password.

This recipe teaches us how to use Nmap to find MS SQL servers with an empty sysadmin password.

How to do it...

To find MS SQL servers with an empty sa account, open your terminal and enter the following Nmap command:

$ nmap -p1433 --script ms-sql-empty-password -v <target>

If an account with an empty password is found, it will be included in the script output section:

PORT     STATE SERVICE 
1433/tcp open  ms-sql-s 
| ms-sql-empty-password: 
|   [192.168.1.102:1433] 
|_    sa:<empty> => Login Success 

How it works...

The parameter -p1433 --script ms-sql-empty-password makes Nmap initiate the NSE script ms-sql-empty-password if an MS SQL server is found running on port 1433.

The script ms-sql-empty-password...