Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

The database server might be running on a nonstandard port. You can set the port manually by specifying the argument -p and using Nmap's service detection:

$ nmap -sV --script ms-sql-brute <target>$ nmap -sV -p 1234 --script ms-sql-brute <target>  

Remember that if an SMB port is open, we can use pipes to run this script by setting the argument mssql.instance-all or mssql.instance-name:

$ nmap -p445 --script ms-sql-brute --script-args mssql.instance-all <target>        

The NSE script ms-sql-brute depends on the brute library, which is highly configurable. Read Appendix B, Brute Force Password Auditing Options,to learn more about the advanced options available.