[boogasystem]

I'm trying to learn everything I can about hacking, but one thing that has came up lots was defacing, how do people just instantly know what to do to deface any website? even if its a new thing they've never defaced before, for example shopify websites, wix websites, wordpress websites, how do they just know what to do without watching a tutorial, is it some special software?

[Bastille]

Defacing is the action of changing the appearance of a website, usually to promote services on someone's else website, for political / religion reasons, or to troll.

There is no tools such as "Automated Defacer 3000", instead you use "usual" vulnerabilities such as SQL injections, LFI, and so on, to gain access to the server, and then change the source code of the web page stored in files.

For other platforms like Shopify or Wix, hackers can also steal owner's credentials, access the control panel, change the email address, the logins, and then deface the website.

[T3n]

There's nothing special nor an software that will let you press a button and deface the website. It takes time, knowledge and persistence. HTB has some useful courses related to web pen testing. Otherwise just start learning.

People don't deface websites that easy. It takes time to find the flaw, some logic on how to do it and so on.

You won't be able to deface a website just by looking at a tutorial.

[Ecca]

You won't be able to deface a website just by looking at a tutorial.

Actually that's not entirely true, you can follow a SQL injection tutorial and deface a website.

[Nightshader]

There actually is some scripts that auto deface but their not real defaces in my opinion. They are from file upload webshells and image uploaders. This is the easy way. But Shelling has a big market and it does work. And there are many other things to do with webshells besides defacing. You can access files on the site execute commands and database access. I like to fuck around with shells and hack my devices and friends when im bored.

[T3n]

Actually that's not entirely true, you can follow a SQL injection tutorial and deface a website.

Not every website is vulnerable to that. Some people think before writing codes.

[boogasystem]

Not every website is vulnerable to that. Some people think before writing codes.

i saw a tutorial and you can check if its vulnerble to sqli

[T3n]

i saw a tutorial and you can check if its vulnerble to sqli

Alright then, go deface websites. :)