[Full-disclosure] SQL Injection + Stored Procedures

2006-10-31 Thread Andres Molinetti
HI, Does anyone know how to get the body of a stored procedure in MS SQL Server through a SELECT statement? In other words, are the Stored Procedures bodies saved in any accesible system table? Cheers, Andy. _ Grandes éxitos,

Re: [Full-disclosure] SQL Injection + Stored Procedures

2006-10-31 Thread m . delibero
Andres, Stored procedures are saved in the syscomments table in the text field. They are then tied to the sysobjects table by the field id. SELECT sc.Text FROM syscomments sc JOIN sysobjects so ON so.id = sc.id WHERE so.Name LIKE '%PROC_NAME%' That query would retrieve the body of the