most sellers around here buy them from other people and resell :( but.... some people hack, sql injects.. find a website, find an sql error then exploit it and inject, get tables + columns dump data blah blah decode the hash i've done it for paypal passwords its easy google sql injection.