rapid7/metasploit-framework — pull request #4261 by nullbind (2014-11-25 16:19:25+00:00)
Title: Added mssql_enum_domain_accounts_sqli.rb

This module can be used via Error Based SQL injection to brute force RIDs associated
with the domain of the SQL Server using the SUSER_SNAME function. This is similar to
the smb_lookupsid module, but executed through SQL Server queries as any user with
the PUBLIC role (everyone).Information that can be enumerated includes Windows domain
users, groups, and computer accounts. Enumerated accounts can then be used in online
dictionary attacks. The syntax for injection URLs is:
/testing.asp?id=1+and+1=[SQLi];--

Lab Guide
https://raw.githubusercontent.com/nullbind/Metasploit-Modules/master/mssql_enum_domain_accounts_sqli_lab.txt

Screenshot
![1](https://cloud.githubusercontent.com/assets/1179731/5186512/64e4ba9c-748c-11e4-8ac6-14f704b43a8a.png)