It's fairly easy to find the low-hanging SQLi vulns on a site automatically, but automatically exploiting them is tough. How do you know where you are in the query, what table/fields to modify/insert into, etc? I'd love to take this apart and figure out how it works.

I went to a presentation once by a guy who does pen testing for banks. He showed us how a script can run google searches for potentially vulnerable sites, and attempt sql injection attacks against them. When vulnerable sites are found, the trick is to query system tables to get the names of all tables in the database, and then just suck everything down for analysis later. He claimed the Russian mob is doing it.