sqlmap
The definitive tool for detecting and confirming SQL injection.
What it does
sqlmap tests your parameters for SQL injection and, where it finds one, safely demonstrates the impact — identifying the database, and showing what data could be read — so a suspected flaw is confirmed beyond doubt.
What data you get
Confirmation of whether any input is injectable, which technique works, the database technology behind it, and the extent of data that flaw would expose.
Why it matters to your site
SQL injection can expose your entire database — every customer record and password. This turns a maybe into a definite yes-or-no on the single most damaging web vulnerability.
More in this category
Other specialised tools
XSStrike
Advanced detection and confirmation of cross-site scripting.
Dalfox
Fast, parameter-focused XSS scanner and verifier.
Commix
Automated detection of command-injection flaws.