Help Centre

Website Security

Website Security

How Websites Get Hacked

Over a million Australian websites get hacked each year, and this can be an extra painful ordeal for businesses. Sadly, the most common thing hacking victims say is, “I never imagined it would happen to me”. Don’t make that mistake; whether you’ve never been hacked or you’re trying to fix the damage from a cyberattack, it’s important to educate yourself on the risks and the best way to protect your website.

How your website can be attacked

Hackers are cunning and creative, employing a wide variety of tactics to penetrate websites. The most common methods include password cracking, phishing, code injections, and other vulnerability exploits. Understanding these common methods is the first step to securing your online presence. The following is a list of just some of the ways in which hackers can attack your site, even if you’re using a unique, secure password.

Blank

Authentication and Access Control Vulnerabilities

Brute force attacks: Using automated tools to try many login passwords on your site until the right one is found.
Broken authentication: Weak login forms that allow impersonation of users or administrators.
Display names similar to usernames: Exploiting visible display names on the site (such as author names) to refine other password cracking methods.

Code and Script Exploits

SQL injection: Tricking the site into running malicious commands that reveal or corrupt data.
Cross-Site Scripting (XSS): Inserting harmful code into the site’s backend that impacts visitors or steals their information.
Cross-Site Request Forgery (CSRF): Tricking logged-in users into performing unwanted actions without their knowledge.
Template injection: Inserting harmful content into the site’s structure, leading to various malicious actions.

Configuration, Permission, and Encryption Issues

.htaccess exploits: Altering configuration directives in your hosted webspace to manipulate the site or steal information.
File and folder permission settings: Breaking in through weak access points on the server to make unauthorised changes.
SSL stripping: Making secure connections insecure to intercept and track the flow of confidential interactions.
Hardcoded secrets: Finding sensitive information (like passwords or hashes) stored insecurely, leading to potential leaks.

Data Exposure, Theft, and Session Attacks

Common database table names and prefixes: Obtaining unauthorised access to database structures to steal or change the site’s information.
Session hijacking / sidejacking: Stealing user session data to impersonate them on the site.
Insecure deserialization: Tampering with data formats to run harmful commands on the site.

Content, File Manipulation, and Malware Attacks

File upload vulnerabilities: Uploading harmful files that can disrupt the site or infect visitors’ devices.
Using malware or Trojan horses: Employing harmful software to break into the site or spy on users.
Directory traversal: Accessing files to modify and ultimately gain full control of a server.

Outdated Components and Vulnerable Software

Outdated platform, plugins and themes: Exploiting old software to take control over the site.
Use of known vulnerable components: Employing outdated or weak parts that can be exploited.
XML-RPC vulnerabilities: Exploiting weaknesses in site communication with other programs.
Insecure Direct Object References (IDOR): Manipulating web requests to access unauthorised data.

User Manipulation and Deceptive Attacks

Clickjacking: Hiding malicious buttons or links under legitimate ones, tricking users into harmful actions.
Phishing: Using secret backdoors to gain unauthorised access to the system.
Email spoofing: Sending emails that look like they’re from the site owner to deceive users.
Replay attacks: Capturing and reusing data to fake legitimate actions on the site.

Network and Server Control Attacks

Server-side Request Forgery (SSRF): Making the server perform unauthorised actions, potentially accessing internal data.
Distributed Denial of Service (DDoS) Attacks: Overwhelming the site with traffic, making it slow or unavailable.
Memory corruption vulnerabilities: Finding errors in the web application’s code to take control of the server.
Insecure APIs: Faults in data transmission between systems that enable unauthorised access or manipulation of data.

Monitoring, Logging, and Specialised Security Flaws

Insufficient logging and monitoring: Failing to track suspicious activity, allowing continued unauthorised access.
Unvalidated redirects and forwards: Making users visit malicious sites unknowingly, often to steal information.

Staying ahead of these threats requires vigilance and an ongoing commitment to security. If you’re exploring website security solutions, you’re already ahead of the average user; just remember — not all website security services are created equal!