How was I able to hack 300 websites in one month ?

Over time, I came to understand many things

. Hacking is extremely illegal. If you are not authorised to scan any website without someone's permission, the consequences can be very severe.

I have mentioned how I became a hacker in a previous article; if you haven't read it yet, please go and read it.

When I started, I was working in a new domain within the technology sector—specifically, I was working with WordPress. WordPress remains the best CMS ever created in history. If you aren't familiar with the term "CMS," let me explain: it stands for Content Management System—a platform that allows you to manage content and edit or publish new material.

At that time, the internet was at a sort of peak—though it still is, the advent of AI has certainly reshuffled the landscape. I had built a website and charged the client $300. He became a long-term client, and I remain deeply grateful for his support. Some time later, I discovered that the site had been hacked. I was initially helpless to fix it, but after two days of effort, I managed to restore the website.

After all this, it had become clear that, beyond just development, there is another factor at play in the market: no matter how good a website looks, sooner or later, it is bound to fall into the hands of hackers.

When I first started this work, there weren't many articles available on the internet explaining how a website functions; and even among the articles that did exist, many were written by people who didn't really understand what a website was themselves.

It all started with search operators.

A search operator is a special type of query that tells you what kind of specific data you have retrieved from a search engine.

This data helps verify whether the information is valuable or not; for instance, I would search for specific endpoints on websites—and indeed, I discovered various endpoints across multiple sites. In the early stages of my journey, I focused on identifying websites with servers that were left exposed. I would visit these sites and examine their files; by analyzing the types of files present, I came to realize that different websites are built using diverse technologies.

Once all of this was underway, I began studying various website technologies, specifically focusing on their back-end and front-end aspects. Gradually, I discovered a new area: API penetration testing. The world was changing, and the use of APIs was rapidly expanding; yet, many developers creating these APIs were unaware of the necessary security measures to implement. I consistently took advantage of these vulnerabilities. Over time, I started reading reports on HackerOne, which helped clarify these concepts for me.

Many changes occurred on the internet after 2022; one specific issue—SQL injection—had virtually disappeared, as the landscape had evolved beyond it to the realm of Remote Code Execution.

After prolonged internet use and conversations with friends, I realized that vulnerabilities were already emerging online; by the time AI arrived, we had already advanced significantly.

Then I found out about another thing, which was that different types of search engines scan IPs. I started using Shadin Zoom and many other search engines like that. Then I understood IP ranges, then IP types, and then how they work. One day, I sat down and scanned.

Scanning such a vast IP range is a highly risky undertaking; one can appreciate the scale of this by realizing it could encompass both private and government institutions. When I performed the scan, I discovered numerous vulnerable servers—specifically, three out of every hundred websites were affected by extremely critical vulnerabilities.

And hackers who have set up botnets—or similar servers—to scan vast numbers of IP addresses derive the greatest benefit from this.

After scanning all these items, I discovered numerous sensitive files and documents, as well as servers that had only just entered the development phase—yet someone had already breached them before that stage was even complete.

Over time, I came to understand many things—one of the most significant being the use of VPNs and how utilizing VPN protocols allows you to examine things in detail.