A bug bounty hunter discovered admin panel access through SQL injection by enumerating historical URLs with waybackurls/gau, filtering for SQL injection patterns with gf, testing with a private tool, extracting admin credentials from the database, and finding the login panel URL in website source code.
A researcher discovered SQL injection on a subdomain to extract admin credentials, then leveraged those credentials to access phpMyAdmin on a different subdomain and achieved remote code execution via a PHP shell upload using MySQL's INTO OUTFILE command.
A complete SSRF-to-RCE exploit chain on AWS Elastic Beanstalk that leverages the EC2 metadata service to extract IAM credentials, then uses those credentials to upload a PHP web shell to an accessible S3 bucket for remote code execution. The attack demonstrates how weak IAM policies can enable escalation from SSRF to full system compromise.