GoogleasaHackingTool.pptVIP

Google as a Hacking Tool James Lee 2005-03-28 Advanced Searching Operators filetype site “” +, -, OR wildcards * and . Operators /article.pl?sid=05/03/02/201216 Operators inurl intext intitle numrange Site Mapping site: Site Mapping site: -site: -site: ... Web Administration phpMyAdmin intitle:phpMyAdmin Welcome to phpMyAdmin running on * as root@* phpNuke inurl:admin.php “There are no Administrators” If you’re an administrator... Please don’t do this Or this. If you’re a developer... Please don’t do this Using the Google cache Everything so far had to request a page from the target’s web server Using Google’s cache, we can avoid this Using the Google cache That didn’t work... This line gives a clue: Using the Google cache Now the conversation is strictly between us and Google. Using the Google cache The difference is “strip=1” No images are requested, only the text that Google keeps on their servers Now we can query anonymously This means fewer entries in IDS logs Conclusions Patches probably won’t help Pay attention to your configuration If it’s not supposed to be public, protect it put it on an internal development host htaccess References / /advanced_search /help/refinesearch.html Questions?Google as a Hacking Tool James Lee 2005-03-28 * * * site: filetype: site: intext:LG3D numrange:2-7 intitle:livecd !! wow! What exactly happens when we click on “Cached” pages? * * these are the results for all of We can refine the search by removing the most common host names to find more interesting stuff. * This is rather tedious and nmap would be more efficient. However, there’s nothing safer than never talking to their server at all. To see how this works, you need to understand what happens when you click “Cached.”