+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Website hacked, but didnt find the Vuln? (/showthread.php?tid=6181828)
Website hacked, but didnt find the Vuln? - PingByte1337 - Nov 20, 2021
Hey Guys, i found a hacked Website.
I would like to see, how the hacker find the vuln.
w w w. sterngold.digitalbrandz.net/
Nmap say
21/tcp open ftp
22/tcp open ssh
25/tcp filtered smtp
26/tcp open rsftp
42/tcp filtered nameserver
53/tcp open domain
80/tcp open http
110/tcp open pop3
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
143/tcp open imap
443/tcp open https
445/tcp filtered microsoft-ds
465/tcp open smtps
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
2222/tcp open EtherNetIP-1
3306/tcp open mysql
i scanned with gobuster a lot of dirs, but all access denied. Now my question, how hacked the guy this site?
RE: Website hacked, but didnt find the Vuln? - Beladonis - Nov 20, 2021
Imagine you were the attacker, and you didn't care about remaining undetected, what would you do to prevent others to compromise your hacked webserver? Well, you would probably remove or patch the vulnerability by sanitizing the scripts, removing page(s), etc. That's probably what they did, hence you can't find an entry way... or you didn't dig deep enough.
RE: Website hacked, but didnt find the Vuln? - PingByte1337 - Nov 20, 2021
(Nov 20, 2021 12:53 PM)Beladonis Wrote: Imagine you were the attacker, and you didn't care about remaining undetected, what would you do to prevent others to compromise your hacked webserver? Well, you would probably remove or patch the vulnerability by sanitizing the scripts, removing page(s), etc.
a deface page? common... at a company where i am on a server, i agree with you
RE: Website hacked, but didnt find the Vuln? - Payload™ - Nov 20, 2021
Basically there is no magic tool to get this done within few clicks. You should re-search every protocol you have posted, do the according tests on them, and after that start looking for a CVE's or another exploits. Kali Linux / ParrotOS is a good place to start, but it will require learning it aswell.
RE: Website hacked, but didnt find the Vuln? - Beladonis - Nov 20, 2021
Okay so apparently the files are still there, it's just that the web server replies 500 Internal Server Error when you try to access PHP files, the hacker threw a wrench into the works by messing with the htaccess or the server configuration.
I found this but I don't think you can do anything useful with that.
So how did the hacker do that? It's hard to tell. Was most likely an SQL injection in my opinion, when things were still accessible.
RE: Website hacked, but didnt find the Vuln? - PingByte1337 - Nov 21, 2021
(Nov 20, 2021 05:47 PM)Beladonis Wrote: Okay so apparently the files are still there, it's just that the web server replies 500 Internal Server Error when you try to access PHP files, the hacker threw a wrench into the works by messing with the htaccess or the server configuration.
I found this but I don't think you can do anything useful with that.
So how did the hacker do that? It's hard to tell. Was most likely an SQL injection in my opinion, when things were still accessible.
Ah Ok, thanks 🙃
RE: Website hacked, but didnt find the Vuln? - 3thicalnoob - Nov 24, 2021
Try Reverse IP Hack Any website then try to hack there server
Code
https://viewdns.info/reverseip/?host=173.254.51.208&t=1or you can try bruteforcing
This website using wordpress
dbran.net/?author=1 USERNAME:admin
Or you can scan there plugin via wpscan
or try Domain Dossier
Here is the details
sterngold.digitalbran.net
Email: surojitbis***@gmail.com
find there pass in leaked db.. and try to login there domain and cp
RE: Website hacked, but didnt find the Vuln? - webking - Dec 11, 2021
You need do a scan for this website on all of ports. Should get something
RE: Website hacked, but didnt find the Vuln? - lorrrra - Dec 11, 2021
Yo bro check your private message please i messaged you
RE: Website hacked, but didnt find the Vuln? - wyvn - Dec 13, 2021
(Nov 24, 2021 12:56 AM)3thicalnoob Wrote: Try Reverse IP Hack Any website then try to hack there server
Codehttps://viewdns.info/reverseip/?host=173.254.51.208&t=1
or you can try bruteforcing
This website using wordpress
dbran.net/?author=1 USERNAME:admin
Or you can scan there plugin via wpscan
or try Domain Dossier
Here is the details
sterngold.digitalbran.net
Email: surojitbis***@gmail.com
find there pass in leaked db.. and try to login there domain and cp
this guy fucks.. "Reverse IP Hack"? crazy
RE: Website hacked, but didnt find the Vuln? - 618C - Dec 13, 2021
man all these trolls here. OP its not related to any open ports, ports doesn't matter for this.
its most likeliy found by using an web app scanner searching for vulnerabilities within the software that runs on the server.
Apache maybe?
Or just another word-press website with obsolete and out of date plugins. ?
looks like they uploaded a shell that give em access to your environment. happens a lot.
there for always make backups.
RE: Website hacked, but didnt find the Vuln? - Vypez. - Dec 16, 2021
Its bu**sh*t, idk why would you do something like this. Better do ransomware lol