--- title: "SQLMap and Commix - Cybr" description: "SQLMap and Commix: a thread from the General Discussions forum on Cybr, with 2 replies. Read-only archive." url: https://cybr.com/forums/topic/sqlmap-and-commix/ --- Topic # SQLMap and Commix 2 replies **Archived.** These forums are read-only. The conversation continues on [Discord](https://cybr.com/discord/). 1. Former member Jun 15, 2021 I know you mentioned with tools there are no guarantees to finding a bug, but with the advent of tools that are specifically designed to find these vulnerabilities. Would it be safe to say that tools are basically a last resort or should be used in manual hunting. Or are tools a better alternative, like the old saying "Work smart not hard" mentality ? 2. Christophe Jun 25, 2021 I don't think anyone can say that one approach is better than another, since it depends on too many factors including what your personal goals are. Like Hakluke mentioned [in his podcast episode](https://anchor.fm/cybr/episodes/How-to-get-started-and-breakthrough-in-Bug-Bounty-Hunting-with-Hakluke-e12v4s1) one of the bounty hunters making the most money on HackerOne right now is almost entirely relying on automated tools. Of course, they've built some of their own tooling and/or extensions for existing tools over the years, so even that requires a ton of work upfront and maintenance along the way. If you're mostly interested in learning and experience, then I think a combined approach is best. You don't want to do everything manually in areas where automation can do a much better job, but you also don't want to rely exclusively on tools since you'll want the hands-on practice. They work hand-in-hand. Former member Jun 25, 2021 Hmm, there is so much information out there and i am trying to stay solely focus on a few things so i won’t get side tracked. So it all comes to down to a balance between automation and manual hunting these days. [< Back to General Discussions](https://cybr.com/forums/forum/general-discussions/)