Google: A Hacker's Best Friend (1)

[imported_alex]

I first read this months ago on this site. It was however, lost, when the site crashed and so I thought that it would be a good idea to put it back up(took me awhile to find a good article on it though ..).
Alot of people already know this but for those who don't then it's a very usefull / interesting read.

-------------------------------------
soup4you2 writes: In the last few years a number of news articles appeared that warned of the fact that hackers (or crackers if you will) make use of the google search engine to gain access to files they shouldn't be allowed to see or have access to. This knowledge is nothing new to some people but personally I have always wondered how exactly a thing like this works. VNUnet’s James Middleton wrote an article in 2001 talking about hackers using a special search string on google to find sensitive banking data:

"One such posting on a security newsgroup claimed that searching using the string 'Index of / +banques +filetype:xls' eventually turned up sensitive Excel spreadsheets from French banks. The same technique could also be used to find password files"[1]

Another article that appeared on wired.com told us how Adrian Lamo, a hacker who made the news often the last couple of years, explained that google could be used to gain access to websites of big corporations.

“For example, typing the phrase "Select a database to view" -- a common phrase in the FileMaker Pro database interface -- into Google recently yielded about 200 links, almost all of which led to FileMaker databases accessible online.”[2]

These articles kept on coming up in the online news. U.S. Military and Government websites were vulnerable because admin scripts could be found using google, medical files, personal records, everything suddenly seemed just one google search away. But these articles seemed to show up once every half year and always talked about it as if it was something new. Another thing was, the articles never explained how one would actually go about doing this. Almost never an example of a search string was given. The last time I read one of these articles I decided it was time to find out for myself, whether google actually could do all they say it can. The following is a report of my findings and a description of some techniques and search strings one could use.

Theory

The theory behind this is actually quite simple. Either you think of certain data you would like to acquire and try and imagine in what files this kind of data could be stored and you search for these files directly. (Search for *.xls files for example) Or you take the more interesting approach and you try to think of a certain software that allows you to perform certain tasks or to access certain things and you search for critical files of this software. An example could be a content management system. You read up on this particular content management system, check out of what files it exists and search for those. A great example is that of the databases mentioned above, where you know the string “view database” is used on pages that shouldn’t be accessible to you and you then search for pages containing that string, or you check the software and notice that the option to view a database is linked on a webpage within this software called “viewdbase.htm” and you search for “viewdbase.htm”

The most important thing is to have a clear goal, to know what it is you want to find. Then search for these specific files or trademarks that these files have.

[imported_alex]

Google Search Options

Specific file types: *.xls, *.doc, *.pdf *.ps *.ppt *.rtf

Google allows you to search for specific file types, so instead of getting html-files as a result (websites) you get Microsoft excel files for example. The search string you would use would be this:

Filetype:xls (for excel files) or filetype:doc for word files.

But maybe more interesting would be searching for *.db files and *.mdb files. Google by the way doesn’t tell you you can search for *.db and *mdb files. I wonder what other file types one can search for. Things that come to mind are *.cfg files or *.pwd files, *.dat files, stuff like that. Try and think of something that might get you some interesting results.

Inurl

Another useful search option is the inurl: option which allows one to search for a certain word one would want to be in the url. This gives you the opportunity to search for specific directories/folders, especially in combination with the “index of” option, about which I will talk later on.

An example would be inurl:admin which would give you results of website urls that have the word “admin” in the url.


Index of

The index of option is another option that isn’t especially thought of by the creators of google, but comes in very handy. If you use the “index of” string you will find directory listings of specific folders on servers. An example could be:

‘index of” admin or index.of.admin

which would get you many directory listings of admin folders. (don’t forget to use the quotes in this case since you are looking for the entire “index of” string, not just for “index” and “of”)


Site

The site option allows you to come up with results that only belong to a certain domain name extension or to a specific site. For example one could search for .com sites or .box.sk sites or .nl sites, but also for results from just one site, but more interesting might be to search for specific military or government websites. An example of a search string would be:

Site:mil or site:gov

Site:neworder.box.sk “board”

Intitle

Intitle is another nice option. It allows you to search for html files that have a certain word or words in the title. The format would be intitle:wordhere. You could check out what words appear in the title of some online control panel or content management system and then search google for this word with the intitle option, to find these control panel pages.

Link

The Link option allows you to check which sites link to a specific site. As described in Hacking Exposed Third Edition, this could be useful:

These search engines provide a handy facility that allows you to search for all sites that have links back to the target organization’s domain. This may not seem significant at first but let’s explore the implications. Suppose someone in an organization decides to put up a rogue website at home or on the target network’s site.“”[4]