Hackers scan for vulnerabilities using automated tools that search for weaknesses in websites and servers. They look for outdated software, misconfigured settings, and known vulnerabilities to exploit. They may also use techniques like port scanning and network sniffing to identify potential targets.