Threat Profiling Microsoft SQL Server

This paper is written from the perspective of an attacker and shows typical “cursi incursi” for Microsoft SQL Server.

An attacker’s location in the application space and/or the network will largely define how they would approach breaking into a SQL Server 2000 machine from a remote location. If their attacks go through SQL Injection via a web server then their ‘cursus incursi’ will be considerably different from those when direct access can be gained to the SQL Server. Consequently, this paper will be split into four main sections. The first section will cover attacks that do not require the attacker to have a user ID and password for the SQL Server, that is, the attacks are unauthenticated. The second section will cover those attacks that do require authentication; to succeed the user must be logged onto the SQL Server. The third section will consider those attacks that can be launched from a compromised server. The final and fourth section will touch briefly upon attacks via the web using SQL Injection.

Download the paper in PDF format here.