Exploitation EngineAUTOMATED NOT AUTHORIZED
⚠️ Authorization Required
The Exploitation Engine will actively exploit discovered vulnerabilities on the target. This constitutes authorized penetration testing activity. You must confirm you have written authorization to perform exploitation against this target before proceeding.
Exploitable Findings
Critical● Idle
SQL Injection — UNION-based via 'q' parameter
SQLi
Critical● Idle
Stored XSS — Profile displayName reflected without sanitization
XSS
Critical● Idle
SSRF — Webhook endpoint fetches internal AWS metadata
SSRF
High● Idle
IDOR — Unauthenticated access to arbitrary user records
IDOR
CriticalSQL Injection — UNION-based via 'q' parameter
/api/products/searchplugin: SQLi
Exploitation Pipeline
1
Connect & Fingerprint
2
Injection Point Detection
3
Schema Enumeration
4
Credential Extraction
5
Privilege Analysis
6
Evidence Packaging
7
Cleanup & Restore
Live Log
Waiting to start… (Authorization required)
Exploitation Results
Run exploit to see results