As a penetration tester interacting with a Microsoft SQL Server (MSSQL), it's important to know certain SQL commands and techniques to help with your assessment. Here are some key commands:

1. Show Databases

To list all databases on the SQL Server instance:

SELECT name FROM sys.databases;

2. Select the Current Database

To check which database you are currently connected to:

SELECT DB_NAME() AS CurrentDatabase;

3. Show Tables

To list tables in the current database:

SELECT table_name FROM information_schema.tables WHERE table_type = 'BASE TABLE';

4. Show Columns in a Table

To list the columns in a specific table (replace your_table_name with the actual table name):

SELECT column_name FROM information_schema.columns WHERE table_name = 'your_table_name';

5. View Table Data

To retrieve data from a table (replace your_table_name with the actual table name):

SELECT * FROM your_table_name;

6. Enumerate Users

To list users in the current database:

SELECT name FROM sys.database_principals WHERE type IN ('S', 'U', 'G', 'C');

7. Enumerate SQL Server Logins