Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: SQL Injection + Stored Procedures
From: m.delibero () comcast net
Date: Tue, 31 Oct 2006 20:42:25 +0000

Andres,

  Stored procedures are saved in the syscomments table in the text field.  They are then tied to the sysobjects table 
by the field id.  

SELECT sc.Text FROM syscomments sc
JOIN sysobjects so ON so.id = sc.id 
WHERE so.Name LIKE '%PROC_NAME%' 

That query would retrieve the body of the stored procedure based on the stored procedure name.  Be warned that the 
stored procedure body can be in multiple rows depending on how big the sp is. 

  Thanks,
  Mike de Libero
 -------------- Original message ----------------------
From: "Andres Molinetti" <andymolinetti () hotmail com>
HI,

  Does anyone know how to get the body of a stored procedure in MS SQL 
Server through a SELECT statement?

In other words, are the Stored Procedures bodies saved in any accesible 
system table?

Cheers,

Andy.

_________________________________________________________________
Grandes �xitos, superh�roes, imitaciones, cine y TV... 
http://es.msn.kiwee.com/ Lo mejor para tu m�vil.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault