Is there any query that I can use to know which SQL platform a website is using ? ( Oracle - MySQL - MSSQL - PostgreSQL - Ingres.... )
Use the SQL Injection cheat sheet. Most databases have a way to query the version e.g.
SELECT @@version. If you have already found an injectable point that returns data try a couple of those until you get data back.
SELECT @@version # fails. Then you know it is not MS SQL or MySQL. SELECT version() # fails. You know it is not PostGres SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; # Succeeds! You know it is oracle.
If those fail use other kinds of queries. You can try timed base injections e.g.
SLEEP 10, or even executing functions such as
TO_NUMBER('10'). Using version specific syntax will let you pretty quickly find out the backend database.
You can also start with some educated guesses. Java web apps often use oracle. .Net often uses MS SQL. PHP often uses MySQL. Django often uses Postgres. Just try specific queries until you get the query to properly execute.
SQLMap can also help fingerprint the backend database. I suggest a combination of using sqlmap + manual testing.
should be enough.
You can test both manually and with tools.For manual analysis first determine the place where the SQL injection exist in the website.
For finding sql injection insert ' or " into the URL of the requsted webpage if it returns an error message then the site and the parameter is vulnerable to SQL injection.
You can also determine the platform in which the website is built using the error message. For example you can visit altoro mutual and login as Username and Password as admin and insert ' in after and before fields in specified URl, you can see the error message shows the details about the database in which it is built.
Otherwise in other websites use SELECT @@version in the URl where sql injection is possible in that website.
As Morgoroth said for manual testing you can use the sqmap