Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap
It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, seeing that they were in the middle of enumerating the tables in our database, we treated it as a genuine penetration and blocked their IP.
The environment in question is Windows based with an IIS webserver and SQL Server 2012 database server.
I've just recently been reviewing documentation for SQLMap and was a little alarmed to see references to Metasploit and uploading of binaries. Until now I thought sqlmap was a passive scanner that would expose data that was previously considered secure, but now I am worried that the act of running SQLMap may have left new vulnerabilities behind.
The machines are regularly patched, behind dedicated firewalls and have virus scanners installed (for what it's worth) so we're taking what we thought were reasonable precautions.
Is any simple evidence to look for or a diagnostic tool to run to see if we're more vulnerable than we thought?