Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

If port 445 is open, you can use it to retrieve the information via pipes. It is required that you set the argument mssql.instance-name or mssql.instance-all : 

$ nmap -sV --script-args mssql.instance-name=MSSQLSERVER --script ms sql-info -p445 -v <target>$ nmap -sV --script-args mssql.instance-all --script ms-sql-info -p445 -v <target>  

The output is as follows:

   PORT    STATE SERVICE     VERSION     445/tcp open  netbios-ssn    Host script results:     | ms-sql-info:     |   Windows server name: CLDRN-PC     |   [192.168.1.102\MSSQLSERVER]     |     Instance name: MSSQLSERVER     |     Version: Microsoft SQL Server 2011     |       Version number: 11.00.1750.00     |       Product: Microsoft SQL Server 2011     |     TCP port: 1433     |_    Clustered: No