SQLMap

What it does

SQLMap detects and exploits SQL injection flaws, automating data extraction, file access, and even OS command execution where the database allows it. It's the standard tool for SQLi testing.

Common use cases

• •Automated detection and exploitation of SQL injection in web application parameters.
• •Dump full database contents — tables, schemas, and credentials — through a blind injection.
• •Gain OS-level access by exploiting database xp_cmdshell or similar features via SQLi.

Key features

• •Supports boolean-blind, time-blind, error-based, and UNION query injection techniques.
• •Automatically fingerprints database engines — MySQL, PostgreSQL, MSSQL, Oracle, and more.
• •Enables file read/write on the remote host through database file-system functions.
• •Supports out-of-band exfiltration via DNS and HTTP channels.

Source