Locate and Attack Domain SQL Servers without Scanning

[Axon]

In short, the author uses a PowerShell script that uses Service Principal Name (SPN) records from Active Directory to identify and attack SQL Servers on Windows domains without having to perform discovery scanning.
https://www.netspi.com/blog/entryid/228/locate-and-attack-domain-sql-servers-without-scanning

[Nero]

Lol if I'm understand what you are saying correctly, you could use a Google dork to list some vulnerable SQL files.

But I get what you mean. I'll try it later.

[luverose]

I'm not get it

[kenjoe41]

Fools, he didn't mean a crooked vulnerable sql database-files. The very intent of this is to dodge this and go straight for the domain server, can't be a better choice sometimes since some admins sluck at updating anything except the web server.

It isn't meant to be understood by the faint of heart, learn some assembly, parser some domain charset binaries then hook in an sql server command. tadar;;;

^don't understand that either.