On: One of my Drupal sites was hacked

[msantos]

An easy start point is checking for large number of XSS-alike requests in your httpd logs.

... a dirty example (I apologise in advance)

    grep --color=auto -i -s -P "(\/cgi-bin\/|\.exe|phpmyadmin|awstats|acunetix|(%22|%27|'|\")(%20| |\+)*and[^\w]|sqlmap|xss|BENCHMARK|eval[^\w]|phpinfo|[^\w]ord[^\w]|md5[^\w]|substr|information_schema|prompt|iframe|base64|waitfor|script[^\w]|[^\w]sleep[^\w]|hex[^\w]|unhex|chr[^\w]|char[^\w]|concat[^\w]|concat_ws|windows.*?win\.ini|union.*?select|etc.*?shadow|etc.*?passwd|\.\.\/|%(25)*2E%(25)*2E%(25)*2F|\.\.%(25)*2F|\/\.\/|%(25)*2F%(25)*2E%(25)*2F|%(25)*2F\.%(25)*2F|\\|%(25)*5C|%(25)*45%(25)*45|%[01][0-9ABCDEF])" access_log