Owned-row SQLi discriminator
Boolean/error probe on a record you created, then a unique canary. No tenant dumps, no --batch spray.
Level: intermediate
Tools: Burp Suite, ghauri, sqlmap, interactsh-client
Pipeline
Document a control request vs a single-parameter syntax probe on {url}. If blind, send one OAST canary per field. Stop at the primitive.