1.Gason：Burpsuite-sqlmap插件，该插件可以让burp与sqlmap轻松对接，深度发掘SQL注入漏洞.

 

2.fuzzdb：fuzzing测试数据库，开源，深度测试SQL注入，xss，文件上传/解析等漏洞（结合intruder使用）.

 

3.bypasswaf：让你轻松绕过waf防御（不要迷信waf）.

 

Reference：

A.gason

http://www.myhack58.com/Article/html/3/7/2014/45418.htm

https://code.google.com/archive/p/gason/downloads

B.fuzzdb

http://www.freebuf.com/sectool/6181.html

https://github.com/rustyrobot/fuzzdb

C.waf baypass

http://www.wooyun.org/whitehats/MayIKissYou

https://github.com/codewatchorg/bypasswaf