Now let's go through each point in more detail!

Let's talk about the choice of the attackers target🎯

There are different groups of attackers who have different targets.  

For example, those who target only big companies (like lapsus), or those who target online games and casinos (like earth berberoka), there is someone like revil (who does not break various resources for personal reasons, such as hospitals, etc.).
So, depending on their orientation, they either take orders on various forms such as exploit.in, cracked.io sometimes xss.is, nulled.to, altenens.is, hackforums.net, evilzone.org and many others (a funny fact, the attackers are often calculated when working with the customer or the transfer of funds, rather than in the hack itself) or self-select target

But in any case, after accepting an order or choosing a target to be hacked, hackers proceed to :
Analyzing the target🧩

This can be done in different ways (e.g.: if the target is a website, the first thing they will need is to find their real server)
To begin with (as the easiest)

They look through search engines such as: Shodan, Binaryedge, Fofa, Censys, ZoomEye. 

Even at this stage, the attackers can somehow compromise the employees to find out such a rad information. Once a real server is found, they scan it with some nmap or similar scanners


Almost always, to access a server, the intruder needs to get into the internal network of the company. 

If a company uses some kind of shared VPN client, hackers can do an intrusion (via phishing or exploiting vulnerabilities in some of the employees accounts).

Here's an example 🌟

We have an airport company. A customer asks someone to encrypt data on that company's server. The intruder(s) takes the order.

First they scan this their target .

Let's say they see that: there is a generic FortiCient VPN in use, our attacker decides to access the network, so first they need to hack the FortiCient VPN

They will do this by exploiting different vulnerabilities (example: link ) or by phishing, or by compromising an employee.
After gaining access to FortiCient, the hackers scan the traffic and find the company's internal server. Attackers scan that server for open ports and vulnerabilities.
And then try to access it, or try to hijack the login session.

In general, this stage (vulnerability testing) is very broad.
So, give another example just this time precisely for the purpose of attackers which is the web site.

The attackers want to get the database of the site 

This site let's say a famous blog, and it is on wordpress and there is a suspicion of sqli .
The first thing the attacker needs is to find out the version of wp and its plugins, and indeed information about it.
He can do this with wpscan. During the scan they find cfdbb7 <=1.2.5.3 , sqli (link) and get the database of the site.

More to scan a website often use web scanners such as: Netsparker, DeepScan, Nessus, Acunetix .
If the purpose of the attack is quite "complicated", then the attackers do step 3 and step 4 together.
#network #wifi #attackers #virus #social_engineering #pentest #attacks #scanners