These are some the ways I have found!
- Brute-force (or not) cracking of weak or default usernames/passwords.
- Privilege escalation.
- Exploiting unused and unnecessary database services and functionality.
- Targeting unpatched database vulnerabilities.
- SQL injection.
- Stolen backup (unencrypted) tapes.
Bookmarks