# run mssql-related nse scripts
nmap -vv --reason -Pn -sV -p1433 --script="(ms-sql* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" --script-args="mssql.instance-port=1433,mssql.username=sa,mssql.password=sa" <target>

# interactive database shell
sqsh -U <user> -P <password> -S <target>:<port>