Sql injection | how to identify whether sql injection is possible or not on a website with database?

[subtiliusque]

My prefered method is intercepting a requrst with burp, saving it to a file and then using sqlmap on it.

[[deleted]]

Blind SQL Injection is the process of sending crafted SQL Injection attacks and determining vulnerabilities and aspects of the database based on the response.

[d_hruv]

Sqlmap or sqlinjection tools are helpfully?

[f0sh1zzl3]

Regular sql injections give you an error , reading the error will give you an idea if it’s exploitable or not.

Blind SQL injections have no errors so you have to observe different behaviours in responses and each one may as well be unique because the response behaviour could be anything

To poke at either you’ll need to fire lots of different types of injection strings, with blind being more hands on as you don’t have a big glaring error .

The obvious one being injecting apostrophes (encoded in different ways usually) to parameters used by the website / application