Attacker fingerprints web application and identifies injectable parameters using automated scanners

Attacker injects SQL payload via vulnerable parameter to bypass authentication or extract data

Attacker dumps database tables including user credentials, session tokens, and sensitive data

Extracted password hashes cracked offline using hashcat/john or plain-text credentials used directly

Valid credentials reused across other systems and services in the environment