Website hacked and defaced....

Viruses and worms
1

See: http://killmalware.com/diazepamabuse.com/#
GoDaddy abuse: http://toolbar.netcraft.com/site_report?url=http://diazepamabuse.com
Read: http://www.leakedin.com/2015/01/21/potential-leak-of-data-hacking-notification-3467/
on: https://code.google.com/p/smilenet4u/ etc. now archived…
shake image script code still available → -http://otowebsite.googlecode.com/files/Getar.js.txt
A script kiddie scan gives following results: Admin Panel Found :http://diazepamabuse.com/admin-login.php/
Admin Panel Found :http://diazepamabuse.com/admin/
Admin Panel Found :http://diazepamabuse.com/admin.php/
Admin Panel Found :http://diazepamabuse.com/adminitem.php/
Admin Panel Found :http://diazepamabuse.com/adminitems.php/
Admin Panel Found :http://diazepamabuse.com/administrator.php/
Admin Panel Found :http://diazepamabuse.com/administration.php/
Admin Panel Found :http://diazepamabuse.com/adminlogin.php/
Admin Panel Found :http://diazepamabuse.com/admin_area/
Admin Panel Found :http://diazepamabuse.com/manager.php/
Admin Panel Found :http://diazepamabuse.com/superuser.php/
Admin Panel Found :http://diazepamabuse.com/access.php/
Admin Panel Found :http://diazepamabuse.com/sysadm.php/
Admin Panel Found :http://diazepamabuse.com/panel.php/
Admin Panel Found :http://diazepamabuse.com/control.php/
Admin Panel Found :http://diazepamabuse.com/member.php/
Admin Panel Found :http://diazepamabuse.com/members.php/
Admin Panel Found :http://diazepamabuse.com/user.php/
Admin Panel Found :http://diazepamabuse.com/manage.php/
Admin Panel Found :http://diazepamabuse.com/management.php/
Admin Panel Found :http://diazepamabuse.com/signin.php/
Admin Panel Found :http://diazepamabuse.com/log-in.php/
Admin Panel Found :http://diazepamabuse.com/log_in.php/
Admin Panel Found :http://diazepamabuse.com/sign_in.php/
Admin Panel Found :http://diazepamabuse.com/sign-in.php/
Admin Panel Found :http://diazepamabuse.com/users.php/
Admin Panel Found :http://diazepamabuse.com/accounts.php/
Admin Panel Found :http://diazepamabuse.com/bb-admin/
etc. etc.

See for reverse DNS: -https://seo217.seoboxes.com/cgi-sys/defaultwebpage.cgi
Issues there: http://toolbar.netcraft.com/site_report?url=https://seo217.seoboxes.com (Poodle)

See: https://oscarotero.com/embed/demo/index.php?url=http%3A%2F%2Fdiazepamabuse.com%2F&options[minImageWidth]=0&options[minImageHeight]=0&options[facebookAccessToken]=&options[embedlyKey]=&options[soundcloudClientId]=YOUR_CLIENT_ID&options[oembedParameters]=

polonus (volunteer website security analyst and website error-hunter)

2

The admin panel probes are generated by a script kiddie script.
I just gave some examples for raising awareness to such methods. :wink:
There are other methods also like there is for instance the fuzzdb php scan:
https://github.com/tennc/fuzzdb/blob/master/dict/BURP-PayLoad/AdminFinder/php.txt

This is how attackers and defacers may approach to get the low hanging php fruit on a particular website,
when not available they are having a hard time and may just go and probe somewhere else…

Damian