Finding system administrator accounts with empty passwords in MS SQL servers
Penetration testers often need to check that no administrative account has a weak password. With some help from NSE, we can easily check that an MS SQL instance has a system administrator (sa) account with an empty password.
This recipe teaches us how to use Nmap to find MS SQL servers with an empty system administrator password.
How to do it...
To find MS SQL servers with an empty super admin account (sa), open your terminal and enter the following Nmap command:
$ nmap -p1433 --script ms-sql-empty-password -v <target>
If an account with an empty password is found, it will be included in the script output section:
PORT STATE SERVICE 1433/tcp open   ms-sql-s | ms-sql-empty-password: |     [192.168.1.102:1433] |_    sa:<empty> => Login Success
How it works...
The -p1433 --script ms-sql-empty-password options make...
