So I just want to highlight why escarole injections are so important and so dangerous.
The reason behind that is they are found, you can find them everywhere and you play a lot of places,
a lot of big websites have these kind of exploits and like things like Yahoo!
Google had them.
It's they're very hard to protect against.
And it's very easy to make a mistake to make these exploits available for exploitation.
The other reason that they are very dangerous is that they give you access to the database in many scenarios,
if you find an ESKIL injection, you really don't need to upload a shell or get a reverse connection.
There is really no point of uploading stuff and then increasing the danger of being caught, because
if you have access to the database, as we see in here, you pretty much have everything you need.
You have usernames, passwords.
You can login with normal username and password as a normal user.
Or you can if you are looking for a sensitive data.
We can see that we had access to credit cards.
You pretty much can do anything you want.
So there is really no point of trying to further exploit the system.
If you found an external injection bingo like that's that's all you need really.
In many scenarios, we actually use a special to gain access to the database and see if we can read
it.
Like, say, for example, if you managed to upload a shell on the server on this overdramatized floatable,
but then you couldn't access the database, you there isn't much that you can see.
You can't see credit cards.
You can see username and password.
You really can.
Yeah, you have control over the server, but you can't read stuff.
So sometimes when you upload Rechelle, the next step is I need to gain access to the database.
Another thing is that they can be used to do many things.
So if you find if you manage to find an ESKIL injection in a website, that is not your target.
So it's not the one that you're targeting, but it's in the same server, then you can use it to read
files outside the WW route.
So similar to file inclusion vulnerabilities, you can use it, you can use the admin, the username
and password for the admin and see if you can upload stuff.
Usually the admin can upload a lot of things instead of just images, and then you can upload a shell
or a back door from there and then from there navigate to your target computer.
Or to the target website, sorry, or you can actually, in some cases, you can use it to upload a
picture, you can use this and ESKIL injection to upload it.
So basically, ESKIL injections can be used as well, including vulnerabilities.
They can be used as file upload vulnerabilities, and also they'll give you access to the whole database.
That's why they are very, very dangerous and very useful if you manage to find one.