As John dug deeper, he discovered that the file had been uploaded to the server through a vulnerable file upload script. The client's website allowed users to upload files, but it didn't properly validate the file type, allowing an attacker to upload the malicious PHP shell.
The ability to browse, query, and dump SQL databases (such as MySQL or PostgreSQL) connected to the web application.
As John was wrapping up his investigation, he received a message from an unknown sender. The message read: "You may have removed the shell, but you'll never catch me. I'll always be one step ahead."