Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights.

The application works with remote MS-SQL server which I don't control, it also seems that the application in question uses integrated security to protect its traffic during transmission. I don't have knowledge on its inner workings (but it's possible to decompile it, it seems, with tools like ILspy), and I don't have any access to network equipment either.

How can I monitor SQL queries it issues? I presume that wireshark won't show anything as traffic will be encrypted. Is it possible to MiM TDS protocol's connection protected with integrated security in such way, that I will be able to see raw TDS stream? Or may be there are some monitoring tools able to hook into windows's protocol stack just beneath the application OSI's layer, like, before it becomes encrypted for transimition?

  • 1
    In plain terms you are just trying to reverse engineer that application and it is not a small process. There is no unique answer for this question and the answer will be opinion based, because reverse engineering has no default path to follow. Different reverse engineers use different tools and techniques. This might help: stackoverflow.com/questions/179741/… techrepublic.com/blog/software-engineer/…
    – ρss
    Jun 17, 2015 at 9:01

1 Answer 1


The best answer to "How can I monitor SQL queries" is to ask the SQL Server administrator to run Profiler.

However, failing that, on the machine you are a legitimate administrator on, you could run the app and a tool to look at your machine's RAM, the simplest example I know of being a simple Hex editor like HxD.

You can also use that same utility or a tool like Strings from Sysinternals to look for clear text SQL statements in the app's files themselves, wherever those files reside on your system.

Microsoft Message Analyzer can at least decode the TDS handshake.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .