> For the complete documentation index, see [llms.txt](https://thescriptkid.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thescriptkid.gitbook.io/notes/credential-less-enumeration/microsoft-structured-query-language.md).

# Microsoft Structured Query Language

## MSSQL Databases

| Default System Database | Description                                                                                                                                                                                            |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `master`                | Tracks all system information for an SQL server instance                                                                                                                                               |
| `model`                 | Template database that acts as a structure for every new database created. Any setting changed in the model database will be reflected in any new database created after changes to the model database |
| `msdb`                  | The SQL Server Agent uses this database to schedule jobs & alerts                                                                                                                                      |
| `tempdb`                | Stores temporary objects                                                                                                                                                                               |
| `resource`              | Read-only database containing system objects included with SQL server                                                                                                                                  |

## Footprinting The Service

### Nmap MSSQL Script Scan

{% code overflow="wrap" %}

```
sudo nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 10.129.201.248
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2F27q8vXNCmakc5iEQvUbQ%2Fimage.png?alt=media&amp;token=169a545b-9936-4e26-a328-3e461edf8306" alt=""><figcaption></figcaption></figure>

### **Connecting with Mssqlclient.py**

{% code overflow="wrap" %}

```
python3 mssqlclient.py Administrator@10.129.201.248 -windows-auth
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2Fo3YSw9idQuyD28oMkrkw%2Fimage.png?alt=media&amp;token=dabdb526-3510-486c-aa90-d0c75a277879" alt=""><figcaption></figcaption></figure>

## MSSQL Commands

| Query                            | Description                                           |
| -------------------------------- | ----------------------------------------------------- |
| `SELECT name FROM sys.databases` | Lists all databases on the SQL Server.                |
| `SELECT * FROM sys.tables`       | Lists all tables in the current database.             |
| `select name from sys.tables`    | Lists the names of all tables in the current database |