1

This may not be a fully Security Question but here's the thing: We have a really old software (released in 2000) that manages some data in the company. Right now we have to create a report from this software like how it manages the employees information. This software connects to a database that is in our server (SQL Server). So I would like to know if there's a way to read the SQL statements that are being sent to the server from the client.

Some details:

It's a .NET 2.0 desktop application Running on Windows 7

NathanWay
  • 559
  • 7
  • 14
  • Sure, WireShark should probably see it, assuming there isn't a middleware component. – crovers Nov 29 '16 at 19:10
  • 1
    If you can alter the connection string used, and the connection is using a trusted connection, you can add ";Encrypt=yes" attribute to it and that will encrypt the data while it's on the network. That will prevent the Wireshark types of attacks. – John Deters Nov 29 '16 at 19:54

1 Answers1

4

Unless the established connection between your software and the SQL server is encrypted by your software, then most likely the traffic can be intercepted and viewed using a network traffic analyzer like Wireshark. By default, SQL server runs on TCP port 1433, so if you have the ability to set up a packet capture, those packets would contain your SQL queries.

John
  • 769
  • 6
  • 10