[shirofuji]

Here's what I do when I want to deface a site.

1. scan for open ports on the website. small sites have port 21 (ftp) or port 22 (ssh) or port 3306 (mysql) open.
2. if i see those port open i try to bruteforce passwords for root.
3. while waiting for brute force results or if ports are not open then i try sql injection
4. if sql injection fails i try to find other vulnerabilities on the server.
5. worst case scenario would be no vulnerabilities are exploitable on the server, in that case I would create a virus and wait for it to reach the server.