Use of Database Client to Access Database

An adversary with a compromised, valid SQL Server login may connect from a network-reachable host with sqlcmd, enumerate databases visible to that login, and collect records it is permitted to read. These steps document a SQL Server example only; Oracle and PostgreSQL clients are not covered. The sqlcmd -o option writes query output to a file on the client host and does not itself transfer that file to another system.