May 24, 2007 at 8:38 am
If it's not running from SQL, how does it even have a spid? I thought spid was used by SQL, kpid was used by Windows.
SQL DBA,SQL Server MVP(07, 08, 09) "It's a dog-eat-dog world, and I'm wearing Milk-Bone underwear." "Norm", on "Cheers". Also from "Cheers", from "Carla": "You need to know 3 things about Tortelli men: Tortelli men draw women like flies; Tortelli men treat women like flies; Tortelli men's brains are in their flies".
May 24, 2007 at 8:59 am
Try this
osql -S "servername;app=appname"
Far away is close at hand in the images of elsewhere.
Anon.
May 24, 2007 at 3:02 pm
Because it connects to SQL Server using connection string.
_____________
Code for TallyGenerator
May 24, 2007 at 11:32 pm
You, Sir, are not only a genius, but you've made my day... I tested it and that is precisely what I was looking for!
I've gotta ask, David... how in the heck did you figure that one out? I beat the heck out of BOL and the Web looking for just that type of information... ya gotta tell me... how did you find it?
--Jeff Moden
Change is inevitable... Change for the better is not.
May 24, 2007 at 11:44 pm
Oh Jeez... the simplicity of your solution is even more proof of your genius... I'm a bit ashamed that I didn't figure it out on my own... much like "SQL Injection" works, you did a "Connection Injection"... absolutely brilliant!
--Jeff Moden
Change is inevitable... Change for the better is not.
May 25, 2007 at 2:29 am
how in the heck did you figure that one out |
Too many years of programming, far too many to mention
I used to use the app property in my connection strings to enable me to do what you are doing and built the string bit by bit (server, user etc), so I thought, well, osql must do the same and if it did not validate the -S param before using it....... then with a simple test, lo and behold it worked.
"Connection Injection" |
never thought of it that way, wonder if anyone tried this to sucessfully attack sql server in some way
p.s many thanks for the compliments, makes me very humble , genius, no, but on occasion...... maybe a flash of inspiration
Far away is close at hand in the images of elsewhere.
Anon.
Viewing 6 posts - 16 through 20 (of 20 total)
You must be logged in to reply to this topic. Login to reply