So the scan is over now and you can see on the left here we have our Web site clicking on it will show
you some results of the spider web.
It was looking for the files the very interesting part is the alerts here.
Right here you can see all the vulnerabilities that have been discovered on the left here.
You can see that we have seven red flags.
So these are the high priority alerts.
We have three orange flags and five yellow flags and zero blue.
So these are organized in the order of their severity
clicking on any of these categories will expand it and show the threats that have been found related
to that threat.
For example clicking on the path traversal you'll see all the or else that can be exploited to read
files from the server clicking on any of these you'll see the hash CTP request that was sent in order
to discover this.
You'll see the response that why the tool thinks that this is vulnerable and we can see that and the
response the tool was able to get the contents of ATC password right here you can see the URL that the
tool used to exploit this vulnerability.
And in here you can see a description of what the current vulnerability is and how it has been exploited.
And here you can see the risk of it.
So this is very high.
You can see the confidence.
So how confident the tool about the existence of this vulnerability you can see that it's been injected
into a page and the attack is trying to get it easy password so let's try and right click on this and
open it in browser and as you can see now it exploited it for us and it showed us the output for this
vulnerability and we can read the contents of ATC password and you can see that the exploit is being
exploited in this you are all right here let's have a look at another example.
For example across site scripting and again the tool also checks for post and get parameters.
So sometimes when the parameter when the injection is sent into text boxes or even sent without text
boxes if it's sent in a post parameter you won't see it in the URL.
So it actually checks for post and get and you can see here it found a vulnerability in a post request
in the register page and it also found one in a gate page.
Again right click and open in browser will execute it for us and we can see the code has been executed.
Again we can have the URL of the execution right here if you want to use it with beef or any other tools
and we can see it in here as well.
Your ad that's being used to exploit this vulnerability let's just have one more example of an Eskil
injection
again click on it it will show you why it believes that there is an as fuel injection here
it will show you the URL and it will show you the attack that are used it used and one equals one
and it's in the parameter password.
And if you remember we actually did exploit this parameter often in this in the browser will show us
that the injection has been is working and it's using their user name and password codes up
so the tool is very simple very powerful and very useful.
You can play around with it.
You can play around with the proxy and with the options and see how you can enhance the results and
achieve even better results.