NetExec icon indicating copy to clipboard operation
NetExec copied to clipboard

Add mssql_dumper module for sensitive data discovery

Open LTJAXSON opened this issue 8 months ago • 1 comments

Description

This module adds a powerful and flexible capability to NetExec for discovering sensitive data across all databases and tables in a target MSSQL server.

It supports both column-based matching and regex-based value scanning, making it ideal for red teams, penetration testers, and incident responders looking to identify data exposure quickly and effectively.

Features

PII-based column matching
Automatically identifies sensitive data using a built-in list of common keywords (e.g., username, password, token, dob, etc.)

Custom column filtering via LIKE_SEARCH
Operators can supply their own comma-separated keywords to refine column-based discovery.

Regex-based content scanning with REGEX
Searches all columns for specific data patterns (e.g., hashes, credit card numbers, tokens) using regex — regardless of column name.

Dual matching logic

    Full row output for column matches (PII or custom)

    Targeted matched-cell output for regex matches

JSON reporting
Matches are saved by default to /tmp/[timestamp]-[hostname].json, with metadata for both column and regex matches.

Performance-aware scanning
Avoids constant rescanning by leveraging precise queries and supports toggling SAVE to prevent unnecessary file output.

Example Usage

nxc mssql 10.129.204.177 -u user -p 'Password123' -M mssql_dumper \
  -o LIKE_SEARCH=secret,email \
  -o REGEX='(?i)bearer;\d{4}-\d{4}-\d{4}-\d{4}' \
  -o SAVE=true

image

Roadmap

1 - Support for linked MSSQL servers (planned)

2 - Regex scanning optimizations

3 - Optional data classification engine integration

LTJAXSON avatar May 19 '25 14:05 LTJAXSON

Thanks for the PR! I will take a look at it when i find the time :)

NeffIsBack avatar May 19 '25 23:05 NeffIsBack