In one sentence: Port 1433 is the door that applications use to talk to a Microsoft SQL Server database, and it should almost never be open to the internet.

What runs on this port

Microsoft SQL Server is a database product that stores business records such as customers, orders and accounts. The IANA registry lists ms-sql-s on TCP port 1433, and the Microsoft SQL Monitor service on UDP port 1434.

Microsoft’s documentation explains that a default instance of the Database Engine normally uses TCP port 1433. A named instance picks an available port each time it starts, unless an administrator fixes it. UDP port 1434 may be needed for the SQL Server Browser service, which tells clients which port a named instance is using.

Microsoft also notes that TCP port 1434 can be used for the Dedicated Administrator Connection on the default instance, and that remote DAC connections are not enabled by default.

Why attackers look for it

A database holds the data attackers want, in one place. If the port is reachable from the internet, anyone can try to log in, and any flaw in the service is exposed.

The port numbers are standard and published in the IANA registry, so a scanner knows exactly where to look.

How it gets attacked

• Password guessing. SQL Server logins can be tried repeatedly if the port is exposed.
• Application flaws. If a web app builds queries unsafely, an attacker can reach the database through the website. That is SQL injection, which needs no open database port.
• Service flaws. CVE-2002-0649: the National Vulnerability Database (NVD) records buffer overflows in the Resolution Service of SQL Server 2000 and MSDE that let remote attackers cause a denial of service or execute code through UDP packets to port 1434. It scored 7.5 on CVSS v2.
• Broad firewall rules. Rules opened for convenience, such as allowing all addresses, leave the database reachable.

Who it affects and how badly

• Sole trader to 10 staff: a line-of-business package on a small server. Worst case: records stolen or deleted, and the business cannot trade.
• 10 to 50 staff: accountancy, legal and estate agency firms with practice management databases.
• 50 to 250 staff: manufacturers, retailers and care providers with stock, finance or patient systems.
• Regulated businesses: a database breach is a personal data breach in the UK, EU, US and Armenia, with potential fines and lost clients.

How to check whether yours is exposed

• Read your firewall rules for inbound TCP 1433 and UDP 1434, and for any fixed port used by a named instance.
• Check the SQL Server error log for the port each instance is using.
• Check the SQL Server network settings to see whether remote connections are enabled.
• List which applications and users connect and from where.
• Run the free web vulnerability scan on any web app that uses the database, and check your public addresses from outside your network.

How to secure it

1. Do not expose SQL Server to the internet. Keep it on an internal network.
2. If remote access is needed, use a VPN or a private link, and allow only specific addresses.
3. Open only the ports you need. Microsoft says to restrict ports that are not required (Analysis Services example).
4. Give each application its own account with the minimum rights, and avoid using the administrator login.
5. Use long, unique passwords and prefer Windows or Entra authentication where it fits.
6. Install SQL Server security updates promptly.
7. Fix application code so queries are parameterised, which blocks SQL injection.
8. Back up the database and test the restore.

Related terms

• port 3306 mysql
• sql injection
• brute force attack
• nmap
• patch management
• password spraying

Frequently asked questions

What ports does SQL Server use?
The default instance normally uses TCP 1433. UDP 1434 may be needed for the SQL Server Browser service when using named instances.

Should SQL Server be reachable from the internet?
Almost never. Keep it on an internal network and use a VPN or private link for remote access.

What was CVE-2002-0649?
The NVD records it as buffer overflows in the SQL Server 2000 Resolution Service, reachable by UDP packets to port 1434.

Sources

• Microsoft Learn, configure the Windows Firewall to allow SQL Server access: https://learn.microsoft.com/en-us/sql/sql-server/install/configure-the-windows-firewall-to-allow-sql-server-access
• NVD record for CVE-2002-0649 (SQL Server Resolution Service): https://nvd.nist.gov/vuln/detail/CVE-2002-0649
• IANA service name and port number registry: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.