The systems of Host Gator, a company that hosts over 8 million domains, have been breached by s3rver.exe. The hacker described the attack in a Pastebin document.

By leveraging a post cookie injection present on the site’s tickets subdomain, he managed to obtain the administrator’s password. Then he uploaded a shell that allowed him to gain access to the domain files of hostgator.com.

The data dump doesn’t seem to contain any sensitive information, but it shows that he has possessed access to certain restricted areas.

After the next phase, which s3rver.exe described as being a man-in-the middle attack, he contacted a member of Host Gator’s support team, asking him why the tracking.hostgator.com domain is down. The technician confirmed that for some reason there appeared to be “an issue on the server.”

At press time, the files uploaded by the hacker onto the tracking subdomain were still there

http://www.ehackingnews.com/2012/06/host-gator-hacked-by-s3rverexe.html

Wow.. Is this a joke? If almighty hostgator could get hacked, then i can hack nairaland then. Make i activate my Mysql injection take test nairaland vulnerability before i inject am

LooL. .Seun don ready for u

Make he ready well because all nairaland web servers go melt tonight. Na my pc don ready pass am

If Hostgator can get hacked then most websites are at the mercy of hackers.

No system is ever 100% secure. Systems are only as secure as they can be at the given time. At best, one can only mitigate. Of course, it is more damning considering the name involved.

This Yawa babe get brain ooo. Chie

Oh well, no major damage has been done.

soloqy: Oh well, no major damage has been done.

You think?

Look at this >>>

Then he uploaded a shell that allowed him to gain access to the domain files of hostgator.com.

I'm so sure the hacker's got more than 1 Backdoor shell on the 8 million+ domains they host. .

Big deal, even facebook sef was hacked at some point. Gmail was hacked at one point too, in fact, i learnt how to hack gmail back then, before them closed the security hole.
Anyone can get hacked, hackers are always busy just like programmers are always busy too. . . . .

*dhtml:
Anyone can get hacked, hackers are always busy just like programmers are always busy too. . . . .

Yeah true. .but then, hackers are always a step ahead

Well, the fact that hackers are always a step ahead is coupled with the fact that, hackers usually get some assist from programmers.

Programmers make backdoors for them, even make hacking tools for them, or make some tools that can be potentially used for hacking. . . .and some good programmers too are hackers. So programmers and hackers are like police and thief in a way, viruses and antiviruses. . . . .it is an endless cycle.

Folks, as we think it is cool to "test hack" websites, realize that the US has a law that says that even recreational hacking is a felony. Let's also not forget that the US has a repatriation agreement with Nigeria.

#justSaying

82% of problems related to hacking come from email vunerability. Email is the easiest thing to get hacked on this plannet earth. A new born baby hacker can hack a weak email. Even the email providers are not aware of this. If i can get to know the primary email to you facebook account, then that facebook account is fully in my control unless if you decided to change the primary email, replace with normal facebook email e.g slyr0x@facebook.com Or change your email passkey to a very strong encrypted password which will be impossible to decode. Then the hacker will be left crippled.. Daz for email but for website, MySql and bruteforce attack are more poplular and most frequently used but no longer effective because almost everyone has learnt how to avoid it. Hackers are not sleeping, more techniques are yet to come. No one is a born hacker. We all learn it. And if you want to learn hacking, I will advise you to use => www.evilzone.org ... The guys there are truely evil and teaching us how to be evil as well

This is sad, it seems the hacker just want to prove his/her skill only nothing more.

Oh i forget to add something. If you are registing with that www.evilzone.org , dont register with your real email. Because any misbehavior like spamming, placing of thread in a wrong folder or use of abusive languages would get your email hacked as a form of punishment and will be released only if you publicly apologise to the admins. It is truely an evil zone. Handle with care. Dont make any freind or show your real identity... At the front of the the website, you will see "Common, We will like to know you before you start spamming on this board!" lol. Dont let them know you ooo. Make them no knack you apkako

*dhtml:
Big deal, even facebook sef was hacked at some point. Gmail was hacked at one point too, in fact, i learnt how to hack gmail back then, before them closed the security hole.
Anyone can get hacked, hackers are always busy just like programmers are always busy too. . . . .

even google sef

*dhtml:
Well, the fact that hackers are always a step ahead is coupled with the fact that, hackers usually get some assist from programmers.

Programmers make backdoors for them, even make hacking tools for them, or make some tools that can be potentially used for hacking. . . .and some good programmers too are hackers. So programmers and hackers are like police and thief in a way, viruses and antiviruses. . . . .it is an endless cycle.

Well said bro. .Well said!

Good Programmers can make a switch to hacking. .quite easily. .unlike the other way round.

mrperfect: This is sad, it seems the hacker just want to prove his/her skill only nothing more.

Quite correct but then great hackers don't make the news . .They can have access to hostgator's servers for years without making their presence known/noticed. .

Peterson1993: Daz for email but for website, MySql and bruteforce attack are more popular and most frequently used but no longer effective because almost everyone has learnt how to avoid it.

Not completely true bro. .SQL Injection occurs when your forms/fields/parameters/etc aint properly validated. .Yeah we all(most people) know that. .but then "Do you know a malicious person can pull your entire database via your cookies/Headers/Referrals/User-Agents?" . .

Most times, we feel validating our forms is all there is to securing our web apps from getting injected but then what happens to other "potential holes" left unattended to like the ones I mentioned above?

Noticed it yesterday when the sites wasn't loading at all. Glad it has been fixed.