The next step in penetration testing a database is to check authentication precisely. Metasploit has a built-in module named mssql_login, which we can use as an authentication tester to brute force the username and password of an MSSQL server database.
Let's load the module and analyze the results:
As soon as we run this module, it tests for the default credentials at the very first step, that is, with the username sa and password blank, and finds that the login was successful. Therefore, we can conclude that the default credentials are still being used. Additionally, we must try testing for more credentials in case ...
