SQL Server
Microsoft's relational database.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- DataSQL Server
About
SQL Server is Microsoft's relational database, where applications such as SharePoint keep their records. It usually runs on Windows Server and listens on port 1433. A database holds the data an attacker is usually after, so a flaw or weak account here is serious.
How to Spot It
These are signs that a system runs SQL Server, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Default port
1433 (SQL Server)- Default port
1434 (SQL Server Browser, UDP)
If It Has a Flaw
A database holds the records an attacker wants. A flaw or a weak account here can expose everything stored. Features such as xp_cmdshell, which runs operating system commands from inside SQL Server, have turned database access into server access.
Rivals
Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach SQL Server.
Stacks and Code
SQL Server is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- In Common Stacks
- SharePoint, On Premises
- Its Code Comes From
- Vendor Updates