10 Deadly Sins of SQL Server Configuration
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 17:15· Annenberg Community Beach House: Track 3, 415 Pacific Coast Hwy·
summary
Starts with concrete failures and tools not fuzzy topics: default sa or sysadmin service accounts in connection strings, service accounts running as Local/System or Domain Admin, and unsafe impersonation like execute as owner / TRUSTWORTHY or unsigned stored procedures. Demonstrations use xp_cmdshell and xp_dirtree to steal hashes and run commands, SPN/Active Directory discovery for inventory, Metasploit and PowerShell modules to automate escalation, and chained linked servers to pivot — fixable by least privilege, certificate signing, and denying public execute.
AI-written summary · about
chapters (27)
- 0:00Start
- 1:00Sql Server Security Basics
- 1:14Security Rates
- 2:10Where Are Security Breaks
- 2:40Security Basics for Sql Server
- 3:40Security Principles
- 4:58Sysadmin Role
- 5:20Database Owners
- 5:49Basics
- 6:37Using Service Principle Names
- 11:12Logins within Personate Privilege
- 13:33Practical Attack
- 15:32Sql Injection Module
- 20:41Sql Injection
- 23:54Exporter for Stored Procedures
- 32:14Sql Injection Point
- 34:00Sql Server Counts
- 34:17Service Account Has Domain Admin Privileges
- 35:00Shared Accounts between Unrelated Applications
- 35:42Sql Server Agent
- 36:39Attack Requirements
- 37:56Ossql
- 38:49Smb Relay
- 42:58Clustered Services
- 43:31Donating Users Assigned Accessibilities
- 47:57No Transport Encryption
- 49:01Requirements
related talks
21mWhat you can do to protect your SQL Server and why it matters- 21mWhat you can do to protect your SQL Server and why it matters
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
52mDetecting Malicious Activity: Unveiling the Secrets of MS-SQL Logging
20mStop Doing Stupid $%^--How Not to Secure Your Environment
21mSQL Horror Stories
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
49mDon’t Let Your Permissions Be Hijacked!