Re: [Full-disclosure] SQL Injection + Stored Procedures

Andres,

Stored procedures are saved in the syscomments table in the text field. They are then tied to the sysobjects table by the field id.

SELECT sc.Text FROM syscomments sc
JOIN sysobjects so ON so.id = sc.id
WHERE so.Name LIKE '%PROC_NAME%'

That query would retrieve the body of the stored procedure based on the stored procedure name. Be warned that the stored procedure body can be in multiple rows depending on how big the sp is.

Thanks,
Mike de Libero
-------------- Original message ----------------------
From: "Andres Molinetti" <andymolinetti@xxxxxxxxxxx>
HI,

Does anyone know how to get the body of a stored procedure in MS SQL
Server through a SELECT statement?

In other words, are the Stored Procedures bodies saved in any accesible
system table?

Cheers,

Andy.

_________________________________________________________________
Grandes �xitos, superh�roes, imitaciones, cine y TV...
http://es.msn.kiwee.com/ Lo mejor para tu m�vil.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: how to know the table is exist in the database
    ... executing sp_tables stored procedure is better since sysobjects ... >> structure or accesibility might change at some point. ... AFAIK it isn't recommended accessing sysobjects directly because it ...
    (microsoft.public.dotnet.framework.adonet)
  • RE: syntax to print list of SPs
    ... select name from sysobjects where type='u' ... For Stored Procedure ... "Vyshnavi" wrote: ... > This query will give you the objects shipped by Microsoft during installation. ...
    (microsoft.public.sqlserver.programming)
  • Re: Return Results of sp_helptext via ADO
    ... 'basic sql for getting stored procedure text ... strSQLStoredProcBase = "select syscomments.text From sysobjects, ... then loop through recordset, appending row to prvious: ...
    (microsoft.public.data.ado)
  • Re: Renaming Stored Prcedures via EM
    ... Internally SQL Server keeps the stored procedure name in two places. ... Database object names are in table called sysobjects. ... stored in syscomments. ...
    (microsoft.public.sqlserver.programming)
  • Re: Stored procedure to check the syntax of stored procs, views, ...
    ... I use a stored procedure called sp_grep. ... syscomments table and look for references to your target string. ... user functions, views, etc. that contain a reference to this object. ... Since you're looping through sysobjects, you can filter out any object ...
    (microsoft.public.sqlserver.programming)