It says right in the intro that the goal is part of penetration testing, which is about far more than just your web app. The target is typically to compromise t

It says right in the intro that the goal is part of penetration testing, which is about far more than just your web app. The target is typically to compromise the central IDM (e.g. Active Directory) get the password database which contains hashed passwords, then crack those to allow further movement or escalation around a network. This could happen via a vulnerability that allows a normal user to get the database, and then cracking the admin password from there. So many people these days seem to completely forget that not everything is in the cloud, and there are many services in a company that you don’t see as a regular user or developer.