is there any way to find out how I was hacked? What was the weak point?

Question

one of my site hacked few times :( first I lost all databases, some tables were cleared and some of table's data had changed! than at the second hack, all tables were cleared and some php files' codes had been changed :/

it is hosted in Bluehost, and now they advise me some fixing;

5. Fix any loose file permissions (this may be the most common exploit vulnerability)
6. Delete all non-system Ftp Accounts that were created, or at the very least, change the passwords to the FTP Accounts.
7. Remove any Access Hosts by clicking the “Remote Mysql” icon and clicking the Remove Red X by each entry if there are any entries.
8. Check your scripts for any Header Injection attacks, Sql Injection attacks, Cross-Site Scripting attacks, etc., as well as your php.ini file settings.
9. If your scripts are infected, you may want to rollback to the last good snapshot backup of your account. If your backups are also infected, then you may want to consider having us reset your account to start afresh.

I tried to do all these as much as I could, especially about "Header Injection attacks, Sql Injection attacks, Cross-Site Scripting attacks, etc., as well as your php.ini file settings". I'm kind of beginner at this work, so I dont have fully control on thiese things...

my question is; is there any way to find out how I was hacked? What was the weak point?

Answer 1

Do you have any logging? That is usually the first place to look at.

My guess is SQL injection - but only because tables were the first thing that you notices changing.

Also - take care to follow the instructions that you got - to make sure the hacker didn't leave any remaining back door.

Answer 2

Assuming you are using shared hosting, it could actually be attacked via another website running on the same server. If the shared hosting is not set up in a secure way, then sometimes other accounts can be used to read your files, no matter how well you set the file permissions. (Like: when the web server is set up to read any file, then some simple PHP script could be abused to browse files from other users.)