: If config.inc.php or its backups (like config.inc.php.bak ) are accessible, they may contain plaintext credentials for the database. Phase 3: Post-Authentication Exploitation