SQL Injection Attacks and Defense - 2009

122 Chapter 3 • Reviewing Code for SQL Injection
if @dbname is null
begin
end
else
--enumerate all databases.
DECLARE #db CURSOR FOR Select Name from master…sysdatabases
declare @c_dbname varchar(64)
OPEN #db FETCH #db INTO @c_dbname
while @@FETCH_STATUS -1
begin
end
execute find_text_in_sp @text, @c_dbname
FETCH #db INTO @c_dbname
CLOSE #db DEALLOCATE #db
begin
declare @sql varchar(250)
--create the find like command
select @sql = 'select ''' + @dbname + ''' as db, o.name,m.definition '
select @sql = @sql + ' from '+@dbname+'.sys.sql_modules m '
select @sql = @sql + ' inner join '+@dbname+'…sysobjects o on
m.object_id=o.id'
END
end
select @sql = @sql + ' where [definition] like ''%'+@text+'%'''
execute (@sql)
Make sure you drop the procedure when you’re finished! You can invoke the stored
procedure like so:
execute grep_sp 'sp_executesql';
execute grep_sp 'EXEC';
You can use the following T-SQL command to list user-defined stored procedures on an
SQL Server 2008 database:
SELECT name FROM sys.procedures ORDER BY name asc
You can use the following T-SQL script to search all stored procedures within an SQL
Server 2008 database server and print their source, if the respective line is uncommented.
You will need to closely scrutinize the output, but it should help you narrow your search.
DECLARE @name VARCHAR(50) -- database name
DECLARE db_cursor CURSOR FOR
SELECT name FROM sys.procedures;
OPEN db_cursor