Alot Has Been asking this question via inbox, so i decided to place my answer here.
However A short and to the point answer would be this:
They use whatever means necessary. For a more detailed answer, see below.Hackers don't focus on a single point of entry into a system or network, instead, most will do a surface scan for likely"vulnerabilities" that remain un-patched.
This is the easiest way to"get in".For example;Sql injection, cross site scripting, miss-configuredscripts, local file inclusion, remote file inclusion, using Google to find errors in their website that display further information that can be used in an attack. The list is really endless.
If no entry point is found on the surface, the hacker will most likely move on to a deeper scan of the target.For example;Port scanning (to find open ports with potential vulnerable softwarerunning), brute force password attack on FTP and login forms, searching for admin panels to brute force, mapping domains/ips hosted on the same server to further attack "vectors".If none of the above leads to a successful hack, the next step wouldbe to build a file on your target, including names/emails/etc, any information that would help with pulling off a social engineering attack or a spoof attack between employee/boss or vice versa.
One of the easiest ways for hackers to get into large corporate networks usually involves targeting employees who lack common knowledge of internet security (secure passwords, opening email attachments or visiting websites that install backdoors through some form of vulnerability, whether it be browser based or softwarebased, such as; Adobe Acrobat)
I could write a 500 page book on how to gain access or hack into a network, as I stated above, the list is endless.
For Urgent Professional Hacking Advice & Hacking services, you can reach my private inbox via [email protected]