Code execution on the box. Shells and chains, and the category every other finding is quietly trying to become.
A full lab build and exploitation walkthrough for exposed Jolokia JMX endpoints: reflected XSS (CVE-2018-1000129), JNDI remote code execution via a rogue LDAP server (CVE-2018-1000130), and dumping the Java heap to recover credentials.
A public PHP 5.3.3-5.3.6 socket_connect exploit carrying a bind-TCP shell payload, dropped as an uploaded PHP file and located with an nmap sweep of ports 4000-4500.
Chaining a login-form SQL injection through sqlmap's --os-shell into a Linux 2.6.32 local root exploit to go from the 'nobody' user to full control of the server.
