W-ADMIN-PERSISTPersistence

Backdoor Admin Account

Create a fresh admin account in the application, ideally with unobtrusive name ("svc-monitor", "audit_ro") — survives webshell hunts.

§ Where this technique fits

W-ADMIN-PERSIST is catalogued under the Persistence tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 8 on average.

§ Dossiers chaining this technique

SQLi (UNION) → DB dump → admin login
Discover a UNION-based SQL injection on a search/listing endpoint, enumerate the schema, dump the users table, and authenticate as an admin.
step 8 / 8

§ Where this technique fits

§ Dossiers chaining this technique

SQLi (UNION) → DB dump → admin login