How does an attacker approach a website?

Question

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?

Answer 1

From my experience most attackers choose websites randomly. They downloaded some "hacker tool", enter an IP range and start it. Usually such a toolkit exploits a specific bug in a software (like Wordpress, Joomla etc.). If you don't run this kind of software or it is not vulnerable anymore they proceed to the next site.

However if your site is the goal of some targeted attack the attacker will explore your system. He may scan the open ports to see if there is some vulnerable software or will try to find out what kind of website software you run. After he finds it he'll look for some exploit for your system and use it. Usually the easiest one is tried first.

A novice will try some of his standard software while an expert will plan his attack. He tries to collect as much information as he can get. Every single of information can help to get to his goal.

Answer 2

From most of my clients (generally Fortune 100 companies) I can say that most attackers they notice (lets exclude the wide range of scans and script kiddie attacks dropped at the perimeter and DMZ) are very experienced, have extensive resources and follow pretty much the same methodology as the white hats.

An example:

1. Discovery - from public sources
2. Footprinting - can be under the radar of most IDS's
3. Vulnerability Scanning - of web apps, perimeter defences, mail server etc
4. Exploitation - use identified vulnerabilities to get to target or get a foothold
5. Escalation - move from user to admin/root access, or from DMZ to internal network
6. Embedding - rootkit, backdoors etc
7. Cleanup - hide tracks in log files etc

Of course this is just a very high level example, but it gives an idea.

Answer 3

Whether via opportunist attacks sometimes described as scriptkiddie hacking or other, it really doesn't matter, in fact I have found that term to me more of a defamation attempt rather than an apt description of the attacker.

Attackers no matter which colored 'hat' they proport to be supporting...will look at the easy approach first before digging any deeper. Why would an attacker even bother to deep as deep as some of the replies above, if say the webserver was hosting 100 websites that were a mixture of Joomla, Wordpress and outdate versions of osCommerce.

In those along would be a treasure trove of entry points to upload shell code / file managers, and even escalate their way into complete control of the webserver.

In fact the most popular method these days is mass multilevelled exploitation where permanent servers are dedicated to trolling search services like Google, finding vulnerable sites, uploading shell code and appending backdoor code, then logging the sites for further exploitation.

These 'automated attacks' do not differ as much from the individual attacks 'signature' wise, other than the fact that the victim site is generally used more for spreading browser viruses or for proxying attacks onto other vulnerable websites, rather than the stereotypical hacker defacement.

Novices...become experts eventually if they persist with learning about websecurity.

Many individual attackers begin with the easiest methods, i.e. the known web script vulnerabilities, or unpatched server exploit methods as these will often be the quickest and easiest ways of gaining access to a webserver and generally most attackers would not have to go much further than this especially in most shared webserver environments.

Because of this there is a tendency for those that have been exploited, upon discovering how their servers were exploited (i.e. being a mistake of theirs for not keeping their stuff up to date), to then point the stick at the so called 'script-kiddie' when in fact this type of attack is just the most easiest, therefore logically the first and most used method.

Where no methods of entry are easily available, the more tenacious will begin much of what Rory Aslop describes above, the 'grind' approach, which is more time consuming yet often yields very little in the way of entry points.

Failing that some, for example Anonymous types, will then turn to the DDoS hammer styled attacks to knock the webservers offline or at least make it hurt (the politically driven attackers).

There are even some breeds of attackers that do not believe in the server exploitation other than the denial of service attack, and on the other side of that coin, there are attackers that believe the denial of service attack is for the low IQ...

In the end it really is not a straight forward issue that can be answered easily and its a world sometimes full of bigotry and fundamentalism, the ones to really look out for are the tenacious ones, which may originally lack the techno skills to pull something off, but tenacity, as stated, often drives upskilling.