SQLAT is a suite of tools that could be useful for penetration testing a MS SQL Server. The tools are still in development but tend to be quite stable.
The tools do dictionary attacks, upload files, read registry and dump the SAM (using pwdump2, http://razor.bindview.com/tools/files/pwdump2.zip). They do this by wrapping extended stored procedures. There is also a tool for doing a minimal analysis of a SQL Server with output as HTML. You need to be 'sa' to run some of the tools, but this usually is not a problem.
The tool temporarily restores the xp_cmdshell if it is removed and the DLL is still left on the system.
SQLAT works over port 1433, it does not do named pipes. It does not do integrated security either. This because it is based on the FreeTDS driver from http://www.freetds.org/.
