Once you've performed an active scan, follow it up with another good "passive" detection method: the osql -L command. Osql is a tool provided with SQL Server that allows for command-line queries and has a discovery option -L that allows you to query the browser service for SQL server registrations. While not 100% reliable, depending on how well your Windows browser service is synchronizing, it provides a good cross-reference for your active scans by revealing machines that might be behind personal firewalls or that may be using older SQL versions and non-standard ports (thus avoiding your scans).
Chip Andrews, CISSP Chip Andrews is the director of research and development for Special Ops Security Inc. and the founder of the SQLSecurity.com Web site, which focuses on Microsoft SQL Server security topics and issues. He is also the author of SQL Server Security. Copyright 2005TechTarget
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.
Home: 
Chip Andrews, CISSP
