---
name: rt-exploit-mssql
description: "Microsoft SQL Server assessment skill for authorized exposure review, authentication mode, role permissions, linked servers, encryption, application-layer injection, and remediation."
---

# rt-exploit-mssql - Microsoft SQL Server Assessment

## Overview

MSSQL environments often connect identity, Windows administration, linked servers, application permissions, and sensitive business data. This skill reviews risk without enabling disruptive features or modifying production state.

## Prerequisites

- Approved instance list or application endpoint.
- Test account/role.
- Clear prohibition or approval for configuration changes.
- Data access and evidence limits.

## Assessment Areas

| Area | Checks |
|---|---|
| Exposure | Listener exposure, named instances, firewall rules. |
| Authentication | Windows vs mixed mode, weak SQL logins, service accounts. |
| Roles | sysadmin, db_owner, impersonation, unsafe grants. |
| Features | Risky features enabled without business need. |
| Linked Servers | Trust relationships and credential delegation. |
| Encryption | Force encryption, certificate posture, TDE where needed. |
| App Layer | Injection, stored procedure misuse, overprivileged app role. |

## Workflow

1. Confirm instance and role scope.
2. Inventory version, authentication mode, encryption, and privileges.
3. Review linked server and service account exposure.
4. Validate application injection with safe evidence only.
5. Map impact to data classification and Windows/AD relationships.
6. Document remediation by DBA and application owners.

## Evidence

Use configuration screenshots, role summaries, redacted query behavior, and application request pairs. Avoid enabling features or dumping tables unless explicitly approved.

## Remediation

- Use Windows/managed identity where appropriate.
- Remove unnecessary sysadmin/db_owner.
- Restrict linked servers.
- Enforce encryption.
- Parameterize application queries.
- Audit privileged actions and failed logins.

