## Active Scanning Mechanics

How does the bot hack?
It uses **Payload Lists**.

### Example: SQL Injection Check
1.  Finds input `id=5`.
2.  Sends `id=5'`. Checks for "Syntax Error".
3.  Sends `id=5 AND 1=1`. Checks if page loads.
4.  Sends `id=5 AND 1=2`. Checks if page disappears.
If 3 works and 4 fails -> **Vulnerable**.

This creates thousands of requests. Do not run this on fragile legacy servers.