For those struggling with ideas for the SQLi you’ll find handy methods in Full MSSQL Injection PWNage