[.eXe]

I have access to someones webserver for their website and their WHM account. It's a hosting "company" that I have access to. There's about 50 sites running from it currently.
Ideas? Do I deface each website individually?

[Nomad.Null]

If they are hosting the site publicly, you could probably request a bounty in exchange for identifying the vulnerability. It is less shady and more profitable. Still illegal, since you did the test without permission, but you could present it to the web admin as a dare.

"I believe your Web server is highly vulnerable to attack. Would you be interested in a penetration test to pay for any vulnerabilities I find, if I can prove they are there?"

If they agree, you should get written permission and a signature to perform the test and state that you are not responsible for any down-time as a direct result of the test and guarantee not to cause any damage to the data or the web server itself. You can easily make a couple of grand this way...

If they refuse, you could simply go to each of their customers and show them the proof of concept that shows how serious the vulnerability is and make an offer to secure their websites instead.

By no means do I take responsibility or condone any acts of blackmail or sabotage. This is purely a hypothetical scenario.

[.eXe]

That would be good, although I didn't access it via any exploit. I ratted the web host companies owner.

[c00perzz]

I would go with the "greyhat" approach too (at least at first).