Comment by rainonmoon

Great writeup OP! And good luck on your hacking journey. Just in case you haven't come across this yet, when you find parentheses being filtered/encoded in a payload like alert(1), try alert`1` using backticks. Some great resources if you want to take your JavaScript injection to the next level: Brute Logic's XSS cheat sheet and Gareth Heyes's Javascript for Hackers. Some people roll their eyes at cross-site scripting but it's still very powerful and very widespread (and as plugin-baby pointed out, especially when session cookies aren't flagged as HttpOnly, eek.)