[darkninja1980]

How many people use SQLMap?

[reGEN]

It's a standard in penetration testing. It's basically a fuzzer that can confirm that what you found is or isn't an SQL injection vulnerability (as opposed to things like broken parsing). It can identify different types of backends that might be annoying having to manually poke and try each and every possibility/combination. It can even escalate to gain further access besides the typical data querying such as getting shells(?) to see how poorly configured the database is. Use it if you're whitelisted and given permission, otherwise I wouldn't recommend using it.

[darkninja1980]

It's a standard in penetration testing. It's basically a fuzzer that can confirm that what you found is or isn't an SQL injection vulnerability (as opposed to things like broken parsing). It can identify different types of backends that might be annoying having to manually poke and try each and every possibility/combination. It can even escalate to gain further access besides the typical data querying such as getting shells(?) to see how poorly configured the database is. Use it if you're whitelisted and given permission, otherwise I wouldn't recommend using it.

good valid point. Now, what tools would you do in carrying out a database hack?

[reGEN]

It's a standard in penetration testing. It's basically a fuzzer that can confirm that what you found is or isn't an SQL injection vulnerability (as opposed to things like broken parsing). It can identify different types of backends that might be annoying having to manually poke and try each and every possibility/combination. It can even escalate to gain further access besides the typical data querying such as getting shells(?) to see how poorly configured the database is. Use it if you're whitelisted and given permission, otherwise I wouldn't recommend using it.

good valid point. Now, what tools would you do in carrying out a database hack?

Dunno, I'm still new to web h4x

[darkninja1980]

It's a standard in penetration testing. It's basically a fuzzer that can confirm that what you found is or isn't an SQL injection vulnerability (as opposed to things like broken parsing). It can identify different types of backends that might be annoying having to manually poke and try each and every possibility/combination. It can even escalate to gain further access besides the typical data querying such as getting shells(?) to see how poorly configured the database is. Use it if you're whitelisted and given permission, otherwise I wouldn't recommend using it.

good valid point. Now, what tools would you do in carrying out a database hack?

Dunno, I'm still new to web h4x  

no problems