My website had been hacked. Hackers were able to access my database and inject some script into my database, now although I have recovered my website but I want to protect my website from further hacking incidence. So how can I know the vulnerabilities of my website, exploiting which they were able to hack it or how they can hack my database in future and place those types of scripts?

  • 3
    This question is extremely broad and as such will probably be closed. You either have a significant (but fun) learning curve ahead of you in pen testing and secure software engineering or you need to hire someone to help you which will not be cheap. If you go the learning route, I suggest you start with the OWASP Top 10 vulnerabilities and review your application for those. – iainpb Sep 19 '17 at 11:08
  • 1
    Investigating an incident starts by looking into logfiles. Do you keep any? – Arminius Sep 19 '17 at 11:08
  • yes . i have purchased my server space . so where do i have to look ? @Arminius – Tejas Pandya Sep 19 '17 at 11:17
  • There are software for automatic pen testing, you could start by that. Note : to check if your site is vulnerable to sql-injection, check every query if they're parametrized (using ? or :xy notation instead of the putting the value straight in the query). For logs, Arminus was probably talking about logs generated by your application. – Walfrat Sep 19 '17 at 11:17
  • 4
    @Tej if you do not know yo have no business running any public service! Logs are an integral part of any service and you should not only know where they are but also collect and read them on a regular basis! – LvB Sep 19 '17 at 11:27

Finding out the vulnerabilities of a website isn't an easy task. It's quite time consuming, and laborious work. Finding the vulnerabilities in any site goes through following phases:-

  • Reconnaissance :- Which is the act of gathering preliminary data or intelligence of your target.
  • Scanning :- The phase of scanning requires the application of technical tools to gather further intelligence on your target, but in this case, the Intel being sought is more commonly about the systems that they have in place. A good example would be the use of a vulnerability scanner on a target network.

Even after all those hard work, there's a lot of chance that you would get nothing at your side. There are numerous situations when the vulnerability might be of the hosting site or of the database admin or any 3rd party database handlers.

I would definitely advise you leave the Information Security task to be handled by the professionals. It would rather be beneficial to leave it to the well reputed local security firms.

|improve this answer|||||
  • 1
    as i mentioned that . i'm the owner of my website and i don't want to hire professional . that's the reason of this forum . to become aware about security . So leaving this task to be handled by professional is not the answer i suppose. – Tejas Pandya Sep 19 '17 at 11:59
  • 5
    This is sort of true, but blindly running automated pen test tools without really understanding what they do or the output they provide can either leave you with no benefits or worse than you were before (it it wasn't, most of us wouldn't have jobs). Review the OWASP top 10,try to spot what you did wrong, get yourself a copy of XSS Me and SQL Inject browser tools. To be honest this is the place to get specific help on specific issues, so if you come back with a question we're happy to answer, but how was my site hacked with out access to it is very difficult for us to answer. – iainpb Sep 19 '17 at 13:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.