How the most common hacker attacks work and what tools attackers use

Many people picture a hacker attack as a dramatic movie scene: a genius kid breaks through a bank’s defences in seconds. The reality is calmer and all the more dangerous for it. Most attacks are craft work following a proven procedure, with ready-made tools that even a less skilled attacker can obtain today. Let us explain how the best-known attacks actually work and what software is behind them, so you know exactly where to defend.

One important note up front: most of the tools mentioned are so-called dual-use. The same network scanner or password-testing tool is used by an attacker and by the security specialist checking your defences. That is why we name them only at a high level, so you grasp the threat, not as a how-to. The goal is defence.

Reconnaissance first: an attack does not start with the attack

Before anyone strikes, they gather information. They find out what services you expose to the internet, what software versions run, what e-mails your employees use and what public sources reveal about the company. This phase is called reconnaissance and decides success more than anything else.

• Network scanners map which ports and services are open on your address. From that an attacker reads where to try getting in. Related reading: what a port in a network is.
• Search engines for connected devices (such as Shodan) index millions of devices visible from the internet, from cameras to servers. If you have something poorly secured and exposed, it can be found.

Defence: do not expose anything to the internet that does not need to be there. Hide cameras, a NAS and device management behind a VPN and update regularly, so old versions do not reveal known holes.

Phishing: the most widespread and successful attack

The vast majority of successful breaches do not start by breaking code, but with the victim’s click. Phishing is a fraudulent message meant to make you enter a password or open an attachment. It runs in phases: the attacker prepares a fake page imitating a bank or e-mail service, sends out the bait and waits for someone to enter their details.

• Phishing kits are ready-made packages with faithful copies of login pages. The attacker only deploys them and collects the entered passwords.
• Advanced session-theft tools can today defeat even a two-factor login by wedging themselves between you and the real site and stealing the logged-in state.

Defence: verify links, never enter a password from a message and always open the site yourself. We cover it in detail in phishing and fraudulent e-mails and scam messages. And enable two-factor authentication, which stops even an attacker who has your password.

Password attacks: brute force, dictionary and credential stuffing

If a password cannot be obtained by deception, it is guessed. There are three main approaches and all are fully automated:

• Brute force tries every combination of characters in sequence. Against a short password it is a matter of seconds, against a long one a matter of many years.
• A dictionary attack tries lists of the most common passwords and passwords leaked in past breaches. That is why a common password is dangerous even if it feels original to you.
• Credential stuffing takes passwords leaked from one service and tries them on dozens of others. It always works when you use the same password in several places.

The software for this is publicly available: tools like Hydra try logging into services, others (John the Ripper, Hashcat) crack stolen hashed passwords at millions of attempts per second, especially with the help of graphics cards.

Defence: a long, unique password for each service, ideally from a password generator stored in a password manager, and two-factor everywhere. Our strong password guide shows how.

Malware and ransomware: when malicious code gets inside

Malware is a malicious program the attacker smuggles onto a device, most often through an attachment, a fake installer or by exploiting an unpatched hole. It takes different forms depending on its purpose:

• Keyloggers quietly record what you type, including passwords.
• Remote access tools (RATs) give the attacker full control of the device, as if they were sitting at it.
• Ransomware encrypts your files and demands a ransom. Today it is sold as a service (ransomware-as-a-service), so even someone without technical skills can run the attack.

Break-ins are made easier by so-called exploit kits, which automatically try known holes in unpatched software.

Defence: update your system and programs, do not open unexpected attachments and keep proper backups following the 3-2-1 rule. The backup is precisely what turns ransomware into an annoyance instead of a catastrophe. Businesses should go through ransomware protection.

Network eavesdropping and man-in-the-middle

In this type of attack the attacker inserts themselves between you and the service you communicate with and eavesdrops on or alters the traffic. Public wifi networks are the most vulnerable.

• Network traffic sniffers (such as Wireshark) display the data flying across the network. Whatever is not encrypted, they read.
• A rogue access point (evil twin) pretends to be a known wifi, for example in a cafe, and once you connect, everything goes through the attacker.
• Wifi-cracking tools (aircrack-ng and the like) attack weak wireless security, including abusing the WPS feature.

Defence: on public wifi use a VPN, check that sites run over HTTPS, at home use strong WPA2 or WPA3 encryption and WPS turned off. A secured router helps too.

Web attacks: SQL injection and XSS

Websites and applications are a favourite target because they are accessible to anyone. The two best-known attacks abuse badly written code:

• SQL injection slips special text into a form or an address, which the site passes to the database as a command. With poorly handled input the attacker can pull out the database contents, for example user data.
• XSS (cross-site scripting) smuggles a malicious script onto the page, which runs in visitors’ browsers and steals, for instance, their login.

Tools like sqlmap (which automates SQL injection) and testing frameworks such as Burp Suite, also used by security testers, serve to find these holes.

Defence: it is on the website’s side. Inputs must be handled rigorously, the system and components kept up to date and safe libraries used. If you run a website, our advice in how to secure WordPress will help.

DDoS: the flood that takes a service down

The goal of a DDoS attack is not to steal data but to knock a service offline. The attacker sends a huge number of requests at the target at once, until it is overwhelmed and the site stops responding.

The traffic is usually generated by a botnet, a network of thousands of compromised devices (computers, cameras, routers) that the attacker controls at once. There are also ready-made flooding tools and paid services that launch an attack “to order” for a few euros.

Defence: DDoS is hard to handle on your own. Protection on the provider’s side or a service like a CDN, which spreads and filters the surge, helps. For businesses that depend on their website’s availability, availability monitoring and a backup connection make sense.

The common thread: defence is always about layers

If you have noticed, the defence against completely different attacks keeps repeating. That is no coincidence. There is no single button that protects you, but several layers that together make an attack inconvenient and unrewarding:

• Update your system, programs and firmware, so old holes are not open doors.
• Strong, unique passwords plus two-factor authentication on everything important.
• Back up following the 3-2-1 rule, so even a successful attack does not mean data loss.
• Do not expose anything needless to the internet and hide sensitive things behind a VPN.
• Caution with e-mails and links, because the weakest link tends to be the human, not the technology.

You will find a complete overview in the article cyber security principles.

Summary

The best-known attacks are not magic. They have their procedure, they start with reconnaissance, they gain the first foothold most often through phishing or a weak password, and they use ready-made, publicly available software to do it. That is exactly why they can be defended against predictably. Once you put updates, strong passwords with two-factor, backups and healthy caution in place, you make the vast majority of attacks so laborious that the attacker looks for an easier target. And that is precisely the point.

This article is part of our Cyber security overview.