So the scam is over now, and you can see on the left here, we have our website clicking on it will
show you some results of the spider when it was looking for the files.
The very interesting part is the alerts here, right here.
You can see all the vulnerabilities that have been discovered.
On the left here, you can see that we have seven red flags, so these are the high priority alerts.
We have three orange flags and five yellow flags and zero blue, so these are organized in the order
of their severity.
Clicking on any of these categories will expand it and show the threads that have been found related
to that thread, for example, clicking on the path traversal.
You'll see all the or else that can be exploited to read files from the server clicking on any of these,
you'll see the hash tag request that was sent in order to discover this.
You'll see the response that why the tool thinks that this is vulnerable.
And we can see that.
And the response, the tool was able to get the contents of ETEK password right here.
You can see the URL that the tool used to exploit this vulnerability.
And in here, you can see a description of what the current vulnerability is and how it has been exploited.
And here you can see the risk of it, so this is very high, you can see the confidence.
So how confident the tool about the existence of this vulnerability, you can see that it's been injected
into a page and the attack is trying to get ETEK password.
So let's try and right, click on this and open it and browser.
And as you can see now, it exploited it for us and it showed us the output for this vulnerability and
we can read the contents of ETEK password and you can see that the exploit is being exploited in this
URL right here.
Let's have a look at another example.
For example, across scripting and again, the tool also checks for post and get parameters, so sometimes
when the parameter when the injection is sent into text boxes or even sent without text boxes, if it's
sent in a post parameter, you won't see it in the URL.
So it actually checks for post and get.
And you can see here it found a vulnerability in a post request and the registered page.
And it also found one in it gets page again, right, click and open and browser.
Well executed for us and we can see the code has been executed.
Again, we can have the all of the execution right here if you want to use it with beef or any other
tools.
And we can see it in here as well.
The URL that's being used to exploit this vulnerability.
Let's just have one more example of an ESKIL injection.
Again, click on it, it will show you why it believes that there is an Ezekial injection here.
It will show you the URL and it will show you the attack that he used, it used, and one equals one.
And it's in the parameter password, and if you remember, we actually did exploit this parameter often
in this in the browser will show us that the injection has been is working and it's using a username
and password called Zap.
So the truth is very simple, very powerful and very useful.
You can play around with it, you can play around with the proxy and with the options and see how you
can enhance the results and achieve even better results.