How do you find the backdoor on a hacked Magento site?

We compare every core file against Magento’s known-good checksums to surface modified or added files, then scan the full filesystem for PHP web-shells, obfuscated uploaders and suspicious recently-changed files. We review access logs to pin down the entry point and timeline, and audit the database for rogue admin users, malicious cron jobs and injected rows. The goal isn’t just to remove the visible symptom, it’s to find and close every backdoor so the attacker can’t walk straight back in.