What is mssqlhound?

MSSQLHound is a security tool that helps red team operators and security auditors map out how attackers could move through an organization's Microsoft SQL Server environment. It plugs into BloodHound, a popular tool for visualizing attack paths in corporate networks. By adding SQL Server relationships to BloodHound's visual maps, security teams can see things like which database accounts could impersonate others, which servers are linked together, and which credentials might be exploited to move deeper into a network. At its core, the tool connects to SQL Server instances and queries them for information about logins, roles, database permissions, linked servers, and service accounts. It translates all of that data into a format BloodHound can display as a graph, showing how different permissions and relationships could be chained together. You can point it at a single server, or let it automatically discover every SQL Server across an Active Directory domain by querying domain controllers. It then packages the results into a file you can upload directly to BloodHound, or it can push the data there automatically. The people who would use this are penetration testers, red team operators, and internal security teams who need to understand the blast radius of a compromised SQL Server account. For example, if an attacker gains access to a low-privilege database login, this tool helps answer questions like "could they escalate to admin on another server?" or "which linked servers could they pivot to?" The detailed OPSEC documentation also makes it useful for blue teams who want to understand exactly what network traffic and log entries this kind of reconnaissance would generate. The project was originally a PowerShell script and has since been rewritten in Go, which brings faster concurrent collection and cross-platform support. The Go version can scan multiple servers simultaneously, route traffic through SOCKS5 proxies, and support advanced authentication methods like Kerberos and pass-the-hash. It also documents every network connection, authentication event, and SQL query it runs, which is valuable for operators who need to assess detection risk during engagements.