How to hijack a website?

Question

How to hijack a website?

Answer 1

One bloke just did that will be going down for 60 years. Happy retirement to you and goodbye cruel world when you get caught!

Answer 2

1. find vulnerability

2. exploit vulnerability

3. go to jail

Answer 3

What epidavros said is correct however I am going to go into a little more detail on the first two points.

The two most common ways to hijack a website are remote file inclusion and SQL injection.  These classes of exploit all an attacker to run any code on the website they like or run any SQL in the site's database that they like.  Local file inclusion coupled with a file upload comes in third.

Remote file inclusion is where the attacker passes the script a URL and the script downloads that URL and executes the code it finds there.  It is often seen with bits of PHP code like this:

<?php include($_GET['page']); ?>

and a URL that normally looks like this: http://www.example.com/index.php?page=fo... gets turned into this: http://www.example.com/index.php?page=ht...

SQL injection is most frequently done through forms that are submitted to a website.  Most login forms submit a username and a password which are then looked up in a database.  Here's an example in PHP:

<?php

mysql_query("SELECT * FROM users WHERE username = '{$_POST['username']}' AND password = '{$_POST['password']}'");

?>

If an attacker submits a username or a password that contains a single-quote they can break out of the single-quotes the username and password were wrapped in and add their own SQL to the query.  In this case the password ' OR 1=1 -- would grant you access no matter what username you entered.

An SQL injection attack would usually allow the attacker to modify any entries in the database including articles, usernames and passwords and whatever else might be in there.

Both techniques are reasonably easy to defend against as a website creator.  The fact that so many sites get hacked this way suggests that website owners are not all that aware of security.  Most attacks I see are wholesale trawling of the Internet trying the same exploit out on as many servers as they can.  It's more time-efficient for an attacker to do this than to spend weeks attacking a single site with lots of different vulnerabilities.

It should be noted that this information is not illegal itself.  It is a requirement of my job that I learn how to do this so I can prevent people doing it to us.  I'm sure you already know that it would be illegal to actually use any of these techniques to modify a website that you didn't have permission to modify.