Lock Down SQL Server 2005
The hard part about offering live exploitable holes is to block privilege escalation for malicious users. In my case I needed a locked down database where arbitrary SQL can't do any damage. And thus was born Lock Down SQL Server 2005, which teaches you a variety of techniques for hardening your whole MSSQL installation plus specific databases. It also has a world-accessible SQL Shell where you can experiment with a hardened database and attempt white-hat escalation.
Interestingly, we face a similar challenge in real-world production systems (as opposed to websites with kids' pictures :P), where we must run bastard applications guaranteed to have security problems. Hardening our systems against them to achieve a secure whole despite the weak links is what Defense in Depth is all about.
I have posted some code along with the article, I hope the stuff is useful to other people. Try it out!
February 11, 2008 at 1:39 am | Filed Under Security
Subscribe to blog
Comments
One Response to “Lock Down SQL Server 2005”
Leave a Reply
You can also get an full report on all your vulnerabilities and a report on all user permissions across all your servers by downloading this tool for free. http://www.idera.com/Products/SQLsecure/default.aspx