This video quickly shows how to locate SQL servers on an internal network, bruteforce, then gain command line access via payload. The same applies to external, except you wouldn't be pinging an entire range, you'd have a specific target.
Note: Please don't try any of this without the express permissions of the box owner, all in the video is done in a virtualised network owned by me.
Music Information:
ZARDONIC & VOICIANS - Bring Back The Glory
FACEBOOK: / voicians / zardonic Taken from "Vulgar Display Of Bass" album Buy here: http://www.beatport.com/