“Microsoft SQL Server—commonly exposed on TCP port 1433—often holds sensitive data and privileges, making it a high-value target. When SQL authentication is enabled, attackers actively exploit weak credentials to pivot deep into the internal network.”
The sa account has no lockout policy. Not by default — SQL Server logins only enforce Windows password policy, including lockout, if CHECK_POLICY was set when the login was created, and the third-party application vendor whose installer created it almost certainly did not set it. That single fact is why brute-forcing MSSQL remains worthwhile in 2026 while the equivalent attack against a domain account gets you a locked account and a phone call. MS-SQL Password Cracking is a tactical manual built on it.
Enumeration & Exploitation
Map first. The guide starts with nmap -p 1433 -sV to confirm the version and edition before anything loud happens, which is not merely tidy — named instances frequently do not sit on 1433 at all, so an attacker who skips the SQL Server Browser service on UDP 1434 will conclude a host is clean when it is running three instances on dynamic ports.
Then the syntax, across the tools that matter:
- Hydra and Medusa: The parallelised workhorses. Fast, and their default thread counts will happily exhaust the connection pool on a small instance and take the application down with it — turn the concurrency down on production.
- NetExec (nxc): The modern choice on an Active Directory estate, spraying a single likely password across SMB and MSSQL at once and immediately reporting where the credential grants sysadmin.
- Metasploit and Ncrack: Module-driven exploitation and adaptive throttling, with the added benefit that a valid pair found through Metasploit lands in the framework database rather than in your scrollback.
Mapping the Attack Path
Every technique is mapped to MITRE ATT&CK — T1110.001 for password guessing, T1046 for service discovery. Useful for report writing and for aligning with a client’s detection coverage, with one caveat that keeps this honest: a technique appearing on the matrix says the behaviour is catalogued, not that anyone is watching for it. Mapping a finding to T1110.001 is the start of a conversation about whether the SOC would have seen it, not the answer.
Defensive Posturing
Brute-forcing 1433 is not subtle, and the guide turns that into a defensive blueprint — using Zeek or Suricata to fingerprint the connection bursts Hydra and Patator produce. The strongest detection is not the network signature, though, since a slow spray from several sources defeats it. It is SQL Server’s own error log: failed logins are recorded there with reason state 8 for a bad password, and a run of those against sa from a host that has no business speaking to the database is unambiguous. The catch is that failed-login auditing must be enabled and the log must be shipped somewhere. Left at the default, it rolls over locally and nobody reads it.
Who Is This Book REALLY For?
- Red team operators: A unified command reference for cracking MSSQL across six frameworks, which matters mainly because they fail differently against odd versions and having a backup ready saves an afternoon.
- Database administrators: The concrete case against mixed-mode authentication. The honest trade-off is that you often cannot switch it off — some vendor application only speaks SQL auth — so the realistic controls are
CHECK_POLICY, a renamed and disabledsa, and network restriction to the application tier. - Blue team analysts: Direct ATT&CK mappings and the specific artefacts to alert on for anomalous port 1433 traffic.
The Bottom Line
MS-SQL Password Cracking lands on an unflattering asymmetry: the database engine is an enormously sophisticated piece of software, and the way in is usually a service account password chosen in 2016 by an installer, never rotated because nobody knows what would break.
