Error injection (primary key duplication) attack principle

Fundamental

Taking advantage of the fact that the primary key in the data table cannot be repeated, by constructing a repeated primary key, the database will report an error and the error result will be returned to the front end.

SQL description function

Take pet data table as an example to illustrate
Insert image description here

round():

Returns any floating point number in the range [0,1).

count():

Returns the number of column rows for each group.
For example, return the number of rows in the test table.

select count(*) from pet;

Insert image description here
Or, return the number of animals whose genders are female and male in the pet table.

select count(*) from pet group by sex;

Insert image description here

floor():

Round down to get an integer.

floor(0.4)//结果为0
floor(0.99999)//结果为0
floor(1.0001)//结果为1

Primary key error statement

By constructing the following statement, primary key duplication is achieved.

select count(*) from pet group by floor(rand(0)*2);

Reasons for duplicate primary keys:
1. First, you need to know the calculation result of floor(rand(0)*2).
Insert image description here
It can be seen here that the first five digits of the calculation result of floor(rand(0)*2) are, 0, 1, 1, 0, 1. Remember these 5-digit results, you will use them later.

2. Secondly, you need to know the calculation process of the group by statement.
When the group by statement is executed, a blank virtual table will first be created in the memory, and the field name after select will be used as the primary key. The structure of this virtual table is the same as the structure of the final output result. For example, query select age,sex from pet group by key ;. The resulting virtual table structure is as follows. (age, sex) is the primary key of the virtual table.

age sex

After the virtual table is created, data is filled into the virtual table according to the SQL statement. The data operation for each row of the original pet table is divided into two steps. The first step is to obtain the field value corresponding to this row based on the field after the group by statement, and confirm whether the field value is repeated in the virtual table. Step 2 : If duplication occurs, group this row with the duplicate row; if no duplication occurs, obtain the field after group by again, and insert the field corresponding to this row into the virtual table.

3. Finally, the execution process of the following statement can be obtained.
Here, group by simply represents numbers, not columns.

select count(*) from pet group by floor(rand(0)*2);

①Create virtual table pet_v

floor(rand(0)*2)(primary key, not displayed) count(*)

②The first time floor(rand(0)*2) is executed, the result is 0. Based on the result of the current row, query whether primary key duplication occurs in the virtual table pet_v. It was found that no duplication occurred, so floor(rand(0)*2) was executed for the second time to get 1, and the current result was inserted into the virtual table.

floor(rand(0)*2)(primary key, not displayed) count(*)
1 1

③Execute floor(rand(0)*2) for the third time and get the result 1. Check whether primary key duplication occurs in the virtual table pet_v. Duplication was found, so it was incremented by 1.

floor(rand(0)*2)(primary key, not displayed) count(*)
1 2

④Execute floor(rand(0)*2) for the fourth time and get the result 0. Check whether primary key duplication occurs in the virtual table pet_v. It was found that no duplication occurred, so floor(rand(0)*2) was executed for the fifth time to get 1, and the current result was inserted into the virtual table. At this time, a duplicate primary key occurs and the system reports an error.

floor(rand(0)*2)(primary key, not displayed) count(*)
1 2
1 1
Produces an error result:
Insert image description here

Guess you like

Origin blog.csdn.net/qq_45931661/article/details/132165628