[xdlwilliamz]

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.

wow that's cool, i see the dedication :)
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

Depending on the site Itself, I use a number of SQL Injection attack vectors.

Content-Based/Boolean-Based, In-Band SQLi  (Union & Error-Based being the most common) and Time-Based/Blind SQLi. The level of access Is full elevated (admin) privileges. You can edit, update, modify and delete data, and manipulate the database to obtain the Table & Column names, thereby grab sensitive details thereafter.

good to hear it's full privileges 😎
Most tools i have for these attacks are in Linux,
what os do you use, Linux or Windows ? am following your guide now ...