Verify whether the IP address is SQL Server

Question

Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?

Answer 1

The IP address is just a location identifier of a machine- it does not discriminate as to the type of service running on the machine nor does the IP directly indicate the type of machine. This is like giving someone a street address- it could be a business, a house, even a Post Office Box, but you generally have no way of knowing until you see it in person or learn more about it (P.O. Box is generally pretty obvious).

You could have a dedicated machine running mySQL or some other flavor of a SQL service as a database and have that be its only job, but this doesn't mean that the IP is and forever will be a SQL server.

A way to aid in determining the machine's role is by running a full port scan to determine the open ports on the machine. Something like nmap -sU -sT -p- <target_ip> would produce a full port-scan. Once you discovered the open ports (let's say you find 3306 open, which is the known default of the MySQL service) then you can perform further enumeration and determine the services running behind these ports.

As it was mentioned in this post, it is important to note, however, that just because a port associated with a specific service responds to the scan (either open, closed, filtered, etc.), it does not mean that the associated service is the actual service running. This is where further enumeration and even interaction is needed to know with certain what service you are dealing with.

Answer 2

You could always try to connect to it with the sql client. Us the SQL Server client tools or try the python client below.

Using python do a pip install mssqli-cli

mssql-cli -S <server IP> -U <user name> -d <database name>