Methods of attacking database servers

Database servers, often containing valuable data, can be targeted by malicious actors. Up until this point, we have focused on SQL injection, misconfigurations, and operating system issues. Attackers will also often seek to compromise a database server through the use of exploits and vulnerabilities. These types of attacks can be the easiest to leverage, but are also easier to detect as there are plenty of alerts that can be put in place.

In the following sections, we will discuss attacking and exploiting database servers through vulnerability scanning, direct attacks, and the Metasploit exploit framework.

Scanning for vulnerabilities

Attackers might use home-grown, open source, or commercial tools. It’s imperative that defenders scan, update, patch, and monitor databases for vulnerabilities. The first step is to identify the vulnerabilities present. To do this, you can use database vulnerability assessment tools such as the following...