+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: I have access to someones WHM (/showthread.php?tid=4983506)
I have access to someones WHM - .eXe - Sep 11, 2015
I have access to someones webserver for their website and their WHM account. It's a hosting "company" that I have access to. There's about 50 sites running from it currently.
Ideas? Do I deface each website individually?
* - Nomad.Null - Sep 11, 2015
If they are hosting the site publicly, you could probably request a bounty in exchange for identifying the vulnerability. It is less shady and more profitable. Still illegal, since you did the test without permission, but you could present it to the web admin as a dare.
"I believe your Web server is highly vulnerable to attack. Would you be interested in a penetration test to pay for any vulnerabilities I find, if I can prove they are there?"
If they agree, you should get written permission and a signature to perform the test and state that you are not responsible for any down-time as a direct result of the test and guarantee not to cause any damage to the data or the web server itself. You can easily make a couple of grand this way...
If they refuse, you could simply go to each of their customers and show them the proof of concept that shows how serious the vulnerability is and make an offer to secure their websites instead.
By no means do I take responsibility or condone any acts of blackmail or sabotage. This is purely a hypothetical scenario.
* - .eXe - Sep 11, 2015
That would be good, although I didn't access it via any exploit. I ratted the web host companies owner.
* - c00perzz - Sep 11, 2015
I would go with the "greyhat" approach too (at least at first).