Hackers find websites to attack in many ways, such as with automatic scanning tools, search engines and dorks, open source intelligence, and vulnerability databases. They might also use phishing, social engineering, or exploit kits to find website flaws and take advantage of them for bad reasons.