TIPS:
* when searching subdomains or domains, use port scanners and site:x.com to find relative services
* use intext:x (ex. intext:password) and filetype:x (ex. filetype php) to find services
* form post requests are commonly not sanitized (besides login, register)
* even if the page is small and is just some test page, it is probably connected to the sql server