Metasploit Revealed: Secrets of the Expert Pentester

Brute forcing passwords

The next step in penetration testing a database is to check authentication precisely. Metasploit has a built-in module named mssql_login, which we can use as an authentication tester to brute-force the username and password of a MSSQL server database.

Let's load the module and analyze the results:

As soon as we run this module, it tests for the default credentials at the very first step, that is, with the username sa and password as blank, and found that the login was successful. Therefore, we can conclude that default credentials are still being used. Additionally, we must try testing for more credentials if in case ...