Find SQL injection in a parameter that's not obvious. How?

Beyond basic ' or 1=1 -- testing: (1) Test in HTTP headers (User-Agent, Referer, X-Forwarded-For); (2) Test cookies — many apps blindly trust cookies; (3) Test JSON parameters in API endpoints (sqlmap supports JSON body via -r); (4) Test boolean-based — change parameter value, observe page diff (true vs false response patterns); (5) Time-based — IF(condition, SLEEP(5), 0) and observe response time; (6) Out-of-band — DNSlog.cn callbacks for blind SQLi where no direct response exists. Tool: sqlmap with --level=5 --risk=3 --tamper for advanced detection.