Find the paramaters in a web application in a manual way and also in automation.

• SQL Injection — Where to Hunt
  • Signup pages ( chance of header based sqli )
  • Login pages ( chance of header based sqli )
  • Registration pages ( chance of header based sqli )
  • Forgot password
  • Reset password
  • Recovery forms
  • Create Ticket

In GET Request:
1. SQLI in Parameter
<http://testphp.vulnweb.com/artists.php?artist=1> ==> <http://testphp.vulnweb.com/artists.php?artist=1SQLPAYLOAD> == DONE

2. SQLI in Parameter
<http://testphp.vulnweb.com/artists.php?artist=1> ==> <http://testphp.vulnweb.com/artists.php?artistSQLPAYLOAD=1> == DONE

4. SQLI in .php, .aspx, .asp, .jsp, .jspx, .xml filenames
<https://twitter.com/nav1n0x/status/1637514118268608513>
<https://domain.com/login.php> ==> <https://domain.com/SQLPAYLOAD.php>

In POST Request:
5. SQLI in User-Agent
<https://hackerone.com/reports/297478>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87SQLPAYLOAD

6. User-Agent: *
7. X-Forwarded-For: *
8. Don't Forget to put the payload: on All input fields

Use burp suite and send the particular request to burp intruder and mark

• parameter values
• parameters
• headers
  • Cookie:
  • User-Agent:
  • Referer:
  • X-Forwarded-For:
• before parameter
• After parameter
• After site extension
• before site extension

After marking the above ones

paste the below payloads in the payloads tab ( Error based payloads )

'
''
'"
\"
+
-
*
[]
')
'))
'"))
')-
\\\"
;

change the resource pool to sqli one

try url encoded in both ways check and uncheck

start attack and if you find any content length change or any 500 status code.

ITS VULNERABLE

After this use Payloads from fav.txt ( Time based Payloads )

<https://github.com/rix4uni/WordList/blob/main/payloads/sqli/fav-time-based-sqli.txt>

use them in the payloads tab after removing the above error based payloads

use the sqli resource pool

start attack

observe the response recieved