So I just want to highlight why a injections are so important and so dangerous the reason behind that
is they are found you can find them everywhere and you play a lot of places a lot of big websites have
these kind of exploits and like things like Yahoo Google had them it's they're very hard to protect
against and it's very easy to make a mistake to make these exploits available for exploitation.
The other reason that they're very dangerous is that they give you access to the database in many scenarios
if you find an S kill injection you really don't need to upload a BHP shell or get a reverse connection.
There is really no point of uploading stuff and then increasing the danger of being caught.
Cause if you have access to the database as we see in here you pretty much have everything you need.
You have user names passwords you can log in with normal user name and password as a normal user or
you can if you're looking for sensitive data we can see that we've had access to credit cards you pretty
much can do anything you want so it's there is really no point of trying to further exploit the system
if you found an astral injection bingo like that's that's all you need really.
In many scenarios we actually use a BHP shell to gain access to the database and see if we can read
it like say for example if you manage to upload a BHP shell on the server on the server other methods
portable but then you couldn't access the database you.
There isn't much that you can see.
You can't see credit cards you can see username and passwords you really catch the eye you have control
over the server but you can't read stuff.
So sometimes when you upload a BHP shell the next step is I need to gain access to the database.
Another thing is the.
They can be used to do many things.
So if you find if you manage to find an Eskil injection in a Web site that is not your target.
So it's not the one that you're targeting but it's in the same server.
Then you can use it to read files outside the WW route.
So similar to file inclusion vulnerabilities you can use it you can use the admin the user name and
password for the admin and see if you can upload stuff usually the admin can upload a lot of things
instead of just images and then you can upload a BHP shell or a back there from there and then from
there navigate to your target computer or to the Target's website sorry or you can actually in some
cases you can use it to upload IPH Richelle you can use as an Eskil injection to upload a BHP show.
So basically shell injections can be used as file inclusion vulnerabilities.
They can be used as file upload vulnerabilities and also they'll give you access to the whole database
that's why they are very very dangerous and very useful.
If you manage to find one.