When SQL injection encounters xss

This method can be used when the injection cannot obtain the background address or decrypt the hash, provided that the injection point can update or insert data and directly insert xss code (no filtering is required) possible display in the background, such as message and article

One case:
The target station finds a concealed mssql blind note, but cannot find the background address

I switched the garbled characters to bt under win, but I couldn't find the message board for a long time but found the best place. All the menus of this system were saved in the library.

Insert menu decisively

The next day, the system successfully received the message and directly sent the cookie to the backend.

A small tips used by xss.