Website hacking how to find a hole?

Question

Drupal

Hello, there are several sites on Drupal, one for version 6, others for version 7. At some point, the hoster reported malicious code. The code was found, and pieces of the shell were also cleaned. The question is how to understand how the shell ended up on the site?
Judging by the logs, there were no ftp, ssx inputs. That is similar to the post injection. How to check it?
Thanks in advance!

Answer 1

Update to the latest version. Before 7.32 there was a vulnerability. I got hacked too. After the update everything was fine.

Answer 2

Well, if you don’t understand the logs, then no way, apparently a smart enough person turned out not to spoil the logs.
You can have someone audit the entire code for a fee, let them look for where the holes are.
You can also hang up some tricky activity monitor or logger, and wait until the shell is uploaded back :)

Answer 3

look at the date when the shells were created, then go to the apache log and see what requests were at that time.

Answer 4

How to detect a virus on a website? Here are links to shell scanners

Answer 5

There are many ways to hack. It's not always the site itself that's the problem.
Drupal comes out with Security Updates all the time. Until I find out about the problem and release an update of the module, a couple of months may pass.
If I were you, I would check "Status Report" and "Available updates" more often

Answer 6

How to detect a hole:
- check all input forms on the site, especially for loading sites
- check plugins and themes for malicious code
- check the URLs of self-written scripts through which any parameters are passed
- check if someone logged into your FTP then with your credits :) Of course
, you need to have an idea of ​​what the vulnerable code looks like, this is at least the absence of filtering input parameters and the absence of file type checking. You can not manually, of course, but with automated tools like https://metascan.ru or https://acunetix.com