I am creating a "vulnerable web application".
Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-scanner like sqlmap or "burp active scan" to detect?
This is important to me because I want to find out which of the testers are capable of finding the vulnerability without using a scanner.
One way that came to my mind immediately would be if the user had only one chance to submit the form, but that would be too impractical. I could use one time tokens (csrf) but it's relatively easy to instruct a scanner to fetch a new token before every request.