Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't even have running on the server.

Now my question is, what are hackers trying to accomplish by hacking the server. I mean, even IF they manage to hack into plesk and take over some sites for a day or two, I would still be able to hard-reset the whole server thus rendering their efforts useless again?

Why are they doing it? What's the catch?

closed as primarily opinion-based by Adi, Xander, TildalWave, Iszi, Steve Jan 15 '14 at 21:49

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.


The ultimate goal? It heavily depends on the initiator of the attack, but here are some ideas:

Attacker interested in financial gains:

  • It may be worth huge amounts of effort to target high traffic webservers/domains that enjoy a good reputation (The domain name is associated with a trustful service) and then apply phishing techniques (Credit cards, paypal, bitcoin credentials, ...) on the many visiting users. The users are very likely to submit such personal information, because the user feels safe.
  • Integrate the server in a botnet: Servers have usually much more networking power then personal computers and can leverage a DDOS attack.
  • Often financial information as credit cards or paypal billing addresses are stored on the webserver (or the database, that is also compromised by taking over a webserver)
  • Interest in other valuable information such as user credentials or closed source applications that are valuable.
  • Using the captured server as a means to hide traffic. Back in the day I used to install socks5 servers (Can also be implemented in PHP if no compiler is available) to proxify traffic.
  • Using the compromised server to redirect traffic in order to exploit user agents. Javascript redirection to a attacking server with a exploit kit istalled like blackhole. This step might me as sophisticated as you wish: Only redirect clients that have specific plugins installed (Java, flash, silverlight), are a concrete User Agent (old, exploitable IE browser versions...)


  • Pure curiosity
  • Just testing if you can take it over due to a self set intellectual challenge
  • Defacing for political purposes (anonymous?)
  • Vandalism (lulzsec)
  • Use the web server as starting point for further attacks like:
  • Privilege escalation (Can we gain root privs?)
  • Are internal hosts/networks available from the server (Might be the case when the webserver also works as a reverse proxy)

There are many reasons. Hope you get the point.

  • I see, that makes sense. Basically for financial gains it's just a long shot in most cases and it's the few that really have valuable things stored that keeps it going. Thanks for your answer! – Hless Jan 15 '14 at 11:48
  • "Long shots" are much less of a hindrance when you can fire hundreds of shots per second at little to no cost. There are a lot of wordpress sites out there, and if even one in a thousand is vulnerable, a minute's worth of scanning might yield several hits. – Shadur Jan 15 '14 at 12:03
  • 1
    one in thousand? That success rate may hold for automated attacks, but coincidentally I audited around 5 wordpress plugins during the last year and they all have very nasty stored XSS combined with XSRF that lead to RCE. I'd guess one in five wordpress site can be taken over when attacking manually... – Nikolai Tschacher Jan 15 '14 at 12:10
  • 2
    specifically for webservers I'd suggest the attacker interested in profit seem awfully prone to making it a phishing site for paypal/banking/etc - this should probably be top of the list. To answer the OP's question, having a webserver for a few hours of a high-volume phishing campaign can turn a profit; won't matter if the server gets nuked, the creds often get posted elsewhere immediately. – pacifist Jan 15 '14 at 13:10
  • @pacifist: Good point, I added it to the answer. – Nikolai Tschacher Jan 15 '14 at 14:28

The traffic you are experiencing is merely the result of automatic scans by bots that all servers connected to the Internet will experience.

The target of such attacks are the lowest common denominator of servers out there -- badly configured with default passwords or unpatched with announced exploitable vulnerabilities. It is very likely that a server compromised in such a fashion will be added to a botnet for sending out spam emails and other similar activities which can earn the botnet operator a nice profit.

You might notice if your server was compromised but the owner of a server that leaves it unpatched or with default passwords probably isn't going to be monitoring logs very often. Such a server will probably remain compromised for a very long period of time.

  • +1 thanks for answering! I accepted the other answer as it gave more insight in the various goals of the hacker. But I totally agree with the unpatched/botnet thing. However, how would one make money by sending spam mails? Would the sender also have a shady webshop somewhere, or would he hack bank accounts with it or anything like that? – Hless Jan 15 '14 at 11:55
  • @Hless Simple enough things like affiliate links or getting hired to send spam about certain topics. Renting out botnets for various activities are very profitable. – Ayrx Jan 15 '14 at 11:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.