https://app.letsdefend.io/challenge/investigate-web-attack/ In order to have any persistency this payload creates a user called hacker and password as Asd123!!

Simple SQLi with burpsuite

Command Injection in DVWA

Bruteforce attack using Burpsuite