Manual detection means to analyze request by request, using just the Proxy tool and Intruder tool, to detect an error or an unexpected behavior to detect SQL injection.
Imagine you have an application that allows the user to see information about the users registered in a database; to do that, the application will use the following request:
GET /dvwa/vulnerabilities/sqli/?id=1&Submit=Submit HTTP/1.1 Host: 192.168.1.72 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.1.72/dvwa/vulnerabilities/sqli/ Connection: close Cookie: security=low; ...
