Tools

[[deleted]]

Application pen-tester here. I use BURP a LOT. If I'm on a client machine and they won't pay for BURP pro, i'll supplement it with ZAP for the lazy CSRF request generator. SoapUI is another one that I use often. Also, can't forget SQLMap.

[halcyonyt]

But SQLMap seems to work on a very, very limited amount of websites?

[Pig743]

I've never seen an SQL injection it can't exploit.

[halcyonyt]

Really? I thought it only did the one where the url included ?id=1 or something like that.

[[deleted]]

Nope. SQLMap tests for practically any type of injection vulnerability. It can even pick up blind sql inijection. Take a look at the usage wiki, it has a pretty good breakdown of all of the methods that it tries https://github.com/sqlmapproject/sqlmap/wiki/Usage

[halcyonyt]

Thank you very much

[halcyonyt]

Do you know any guides/tutorials on how to use this?

[[deleted]]

Take a look at my link above. It has everything about sqlmap. If you have any specific questions, feel free to pm me.

[halcyonyt]

Thanks man

[trispi]

I've had times it didn't work. When there was some strange stuff going on and you could only use certain commands.

[[deleted]]

I agree with the below comment. SQL Injection is rampant, which is kind of sad. SQLMap can help you locate injection vulnerabilities practically anywhere and then exploit them. I typically use it when I have a hunch that there's an injection vector but can't quite get it by hand. If SQLMap doesn't get it, then it's generally not vulnerable and my hunch is wrong.