In reply to Matthew Miller.

Hackers dont attempt go through passwords. They go after signatures in the codebase. That is to say if a widget has a security issue, sites using said widget are located via automation. Pulling down pages looking for that unique signature. It might be Javascript code, comments in javascript code, stylesheet information, comments in the HTML etc.

The Web Browser object for example that is "MSIE" can be used in any Windows application. The controls in MSIE are basically a wrapper around it. That was source of litigation many moons back with Windows. The integration of MSIE to Windows. Your desktop on your PC showing you your icons is MSIE.

It takes about 6 lines of code to pull a page down from the web as source code. Again, not the PHP code, thats not exposed. But everything going to the client (Web Browser is). Firefox has this same ability, can grab its DLLs (dynamic link libraries) and use it in Windows projects, can write your own web browser.

Traversing a site is simple. Just a recursive deal like traversing a directory on your PC or Binary Tree.

Its sorta funny in a way. Alot of codebases that are open sourced for example say, "You must keep this commentary with the codebase" and the commentary is often in the form of comments. If those comments are exposed in the rendering then there sits a signature.

Hackers dont just hop around guessing. They use automation.

I dont even pretend to understand them, the thrill or whatall they get off it. Satan's work if you ask me. But understanding how its done is not difficult for any Windows or Mac or Linux programmer or perhaps I should say any programmer who has a base skill set in any of the above.

So how might they find security holes? Now that we understand how they locate the sites using perhaps some widget. But how do they find the widget?

Well... It might already be known to have a security matter. Heck, these days I wouldnt be surprised if some coders dont intentionally make a gizmo to later target. Makes ya wonder doesnt it?

But... again using automation an application, even a PHP app on some server someplace can be a client scouring websites throwing SQL at input forms, trying to perform Cross site scripting etc.

Anything can and does happen.

What is unfortunate is that real security audit software is a business as well and the good stuff is expensive.

Whats expensive? Ball park figure for HP Fortify for Web/Mobile is $45,000.