NetExec
NetExec copied to clipboard
Add mssql_dumper module for sensitive data discovery
Description
This module adds a powerful and flexible capability to NetExec for discovering sensitive data across all databases and tables in a target MSSQL server.
It supports both column-based matching and regex-based value scanning, making it ideal for red teams, penetration testers, and incident responders looking to identify data exposure quickly and effectively.
Features
PII-based column matching
Automatically identifies sensitive data using a built-in list of common keywords (e.g., username, password, token, dob, etc.)
Custom column filtering via LIKE_SEARCH
Operators can supply their own comma-separated keywords to refine column-based discovery.
Regex-based content scanning with REGEX
Searches all columns for specific data patterns (e.g., hashes, credit card numbers, tokens) using regex — regardless of column name.
Dual matching logic
Full row output for column matches (PII or custom)
Targeted matched-cell output for regex matches
JSON reporting
Matches are saved by default to /tmp/[timestamp]-[hostname].json, with metadata for both column and regex matches.
Performance-aware scanning
Avoids constant rescanning by leveraging precise queries and supports toggling SAVE to prevent unnecessary file output.
Example Usage
nxc mssql 10.129.204.177 -u user -p 'Password123' -M mssql_dumper \
-o LIKE_SEARCH=secret,email \
-o REGEX='(?i)bearer;\d{4}-\d{4}-\d{4}-\d{4}' \
-o SAVE=true
Roadmap
1 - Support for linked MSSQL servers (planned)
2 - Regex scanning optimizations
3 - Optional data classification engine integration
Thanks for the PR! I will take a look at it when i find the time :)