Skip to main content
IMMUNITYSEC

Port 1433: Microsoft SQL Server Database Engine (TDS)

TCP 1433 is where the default instance of the Microsoft SQL Server Database Engine listens when TCP/IP is enabled. Named instances use dynamic ports by default, which clients look up through the SQL Server Browser on UDP 1434. Applications, reporting tools and administrators connect here.

1433
TCP

Port Details

Port
1433
Transport
TCP
Service
MS SQL Server
IANA service name
ms-sql-s
Range
User port (1024-49151)
Related ports
1434

Security Exposure

A database listener on the internet exposes logins and data directly to remote attackers. Microsoft Defender for SQL includes alerts for suspected brute force attacks, and SQL Server Authentication is less secure than Windows Authentication.

Hardening

  • +Do not expose 1433 to the internet; allow it only from application servers and admin networks.
  • +Prefer Windows Authentication, which Microsoft describes as much more secure than SQL Server Authentication.
  • +Encrypt client connections with TLS by configuring a server certificate.
  • +Keep the sa login disabled and give any SQL logins strong, unique passwords.
  • +Apply the latest SQL Server and operating system patches.

Monitoring

Enable SQL Server Audit at the server level and track failed logins. Alert on login attempts from addresses outside the application and admin ranges.

MS SQL Server Vulnerabilities

1 CVEs
CVETitleVendorCVSSEPSSKEVPublished
CVE-2019-1068
Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft8.857.3%KEV2019-07-15

Tools for Auditing and Monitoring MS SQL Server

Impacket

Free
Penetration Testing Tools

Python library of classes and example tools for the construction, parsing, and interaction with Windows and Active Directory network protocols.

LicenseModified Apache-1.1 (custom; see repo LICENSE)
PlatformLinux, macOS, Windows

sqlmap

Free / Commercial
Penetration Testing Tools

Automated penetration testing tool that detects and exploits SQL injection flaws to assess database security configurations.

LicenseGPL-2.0-or-later (with sqlmap clarifications and exceptions)
PlatformLinux, macOS, Windows

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Related Tool Categories

Data Security Software→

Data loss prevention, data posture management, and sensitive data discovery and classification platforms.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

SIEM Tools→

SIEM platforms, EDR agents, SOAR automation, and detection rule engines for security operations.

Frequently Asked Questions

Is port 1433 TCP or UDP?→

The Database Engine listens on TCP 1433. UDP 1434 is used by the SQL Server Browser service.

Do named SQL Server instances use port 1433?→

Not by default. Microsoft states named instances use dynamic ports chosen at startup, unless configured with a fixed port.

Which vulnerabilities affect the service on port 1433?→

This database lists 1 CVE related to MS SQL Server, 1 of them confirmed as exploited by CISA. Examples: CVE-2019-1068.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 1433 is not guaranteed to be MS SQL Server. Exploited-in-the-wild data from the CISA KEV catalog (CC0).