Google Hacking for Penetration Testers, Volume 2. Syngress

Johnny Long

A Completely New Volume of Google Hacking Techniques

F O R P E N E T R A T I O N T E S T E R S
V O L U M E 2

Google Hacking for Penetration Testers, Volume 2

Lead Author
“I’m Johnny. I Hack Stuff.”
Have you ever had a hobby that changed your life? This Google Hacking thing
began as a hobby, but sometime in 2004 it transformed into an unexpected gift. In that
year, the high point of my professional career was a speaking gig I landed at Defcon. I
was on top of the world that year and I let it get to my head—I really was an egotistical
little turd. I presented my Google Hacking talk, making sure to emulate the rockstar
speakers I admired.The talk went well, securing rave reviews and hinting at a
rock-star speaking career of my own.The outlook was very promising, but the
weekend left me feeling empty.

In the span of two days a series of unfortunate events flung me from the mountaintop
of success and slammed me mercilessly onto the craggy rocks of the valley of
despair. Overdone? A bit, but that’s how it felt for me—and I didn’t even get a Balroc
carcass out of the deal. I’m not sure what caused me to do it, but I threw up my hands
and gave up all my professional spoils—my career, my five hundred user website and
my fledgling speaking career—to God.

At the time, I didn’t exactly understand what that meant, but I was serious about
the need for drastic change and the inexplicable desire to live with a higher purpose.
For the first time in my life, I saw the shallowness and self-centeredness of my life, and
it horrified me. I wanted something more, and I asked for it in a real way.The funny
thing is, I got so much more than I asked for.

Syngress approached and asked if I would write a book on Google Hacking, the first
edition of the book you’re holding. Desperately hoping I could mask my inexperience
and distaste for writing, I accepted what I would come to call the “original gift.”
Google Hacking is now a best seller.

My website grew from 500 to nearly 80,000 users.The Google book project led to
ten or so additional book projects.The media tidal wave was impressive—first came
Slashdot, followed quickly by the online, print,TV and cable outlets. I quickly earned
my world traveler credentials as conference bookings started pouring in.The community
I wanted so much to be a part of—the hacking community—embraced me
unconditionally, despite my newly conservative outlook.They bought books through
my website, generating income for charity, and eventually they fully funded my wife
and me on our mission’s trip to Uganda, Africa.That series of events changed my life
and set the stage for ihackcharities.com, an organization aimed at connecting the skills
of the hacking community with charities that need those skills. My “real” life is transformed
as well—my relationship with my wife and kids is better than it ever has been.

So as you can see, this is so much more than just a book to me.This really was
the original gift, and I took the task of updating it very seriously. I’ve personally
scrutinized every single word and photo—especially the ones I’ve written—to make
sure it’s done right. I’m proud of this second edition, and I’m grateful to you, the
reader, for supporting the efforts of the many that have poured themselves into this
project.Thank you.

Thank you for visiting us at http://johnny.ihackstuff.com and for getting the
word out.Thank you for supporting and linking to the Google Hacking Database.
Thank you for clicking through our Amazon links to fund charities. Thank you for
giving us a platform to affect real change, not only in the security community but also
in the world at large. I am truly humbled by your support.

—Johnny Long

October 2007

Contributing Authors
Roelof Temmingh Born in South Africa, Roelof studied at the University
of Pretoria and completed his Electronic Engineering degree in 1995. His
passion for computer security had by then caught up with him and manifested
itself in various forms. He worked as developer, and later as a system
architect at an information security engineering firm from 1995 to 2000. In
early 2000 he founded the security assessment and consulting firm
SensePost along with some of the leading thinkers in the field. During his
time at SensePost he was the Technical Director in charge of the assessment
team and later headed the Innovation Centre for the company. Roelof has
spoken at various international conferences such as Blackhat, Defcon,
Cansecwest, RSA, Ruxcon, and FIRST. He has contributed to books such
as Stealing the Network: How to Own a Continent, Penetration Tester’s Open
Source Toolkit, and was one of the lead trainers in the “Hacking by
Numbers” training course. Roelof has authored several well known security
testing applications like Wikto, Crowbar, BiDiBLAH and Suru. At the start
of 2007 he founded Paterva in order to pursue R&D in his own capacity.
At Paterva Roelof developed an application called Evolution (now called Maltego) 
that has shown tremendous promise in the field of information collection and correlation.

Petko “pdp” D. Petkov is a senior IT security consultant based in
London, United Kingdom. His day-to-day work involves identifying vulnerabilities,
building attack strategies and creating attack tools and penetration
testing infrastructures. Petko is known in the underground circles as
pdp or architect but his name is well known in the IT security industry for
his strong technical background and creative thinking. He has been working
for some of the world’s top companies, providing consultancy on the latest
security vulnerabilities and attack technologies.
His latest project, GNUCITIZEN (gnucitizen.org), is one of the leading
web application security resources on-line where part of his work is disclosed
for the benefit of the public. Petko defines himself as a cool hunter in the security circles.
He lives with his lovely girlfriend Ivana, without whom his contribution
to this book would not have been possible.

CP is a moderator of the GHDB and forums at
http://johnny.ihackstuff.com, a Developer of many open source tools
including Advanced Dork: and Google Site Indexer, Co-Founder of
http://tankedgenius.com , a freelance security consultant, and an active
member of DC949 http://dc949.org in which he takes part in developing
and running an annual hacking contest Known as Amateur/Open Capture
the Flag as well as various research projects.
“I am many things, but most importantly, a hacker.” – CP

Jeff Stewart, Jeffball55, currently attends East Stroudsburg University
where he’s majoring in Computer Science, Computer Security, and Applied
Mathematics. He actively participates on johnny.ihackstuff.com forums,
where he often writes programs and Firefox extensions that interact with
Google’s services. All of his current projects can be found on
http://www.tankedgenius.com. More recently he has taken a job with FD
Software Enterprise, to help produce an Incident Management System for
several hospitals.

Ryan Langley is a California native who is currently residing in Los
Angeles. A part time programmer and security evaluator Ryan is constantly
exploring and learning about IT security, and new evaluation techniques.
Ryan has five years of system repair and administration experience. He can
often be found working on a project with either CP or Jeffball.


Introduction

Google’s Web interface is unmistakable. Its “look and feel” is copyright-protected, and for

good reason. It is clean and simple. What most people fail to realize is that the interface is

also extremely powerful.Throughout this book, we will see how you can use Google to

uncover truly amazing things. However, as in most things in life, before you can run, you

must learn to walk.

This chapter takes a look at the basics of Google searching.We begin by exploring the

powerful Web-based interface that has made Google a household word. Even the most

advanced Google users still rely on the Web-based interface for the majority of their day-today

queries. Once we understand how to navigate and interpret the results from the various

interfaces, we will explore basic search techniques.

Understanding basic search techniques will help us build a firm foundation on which to

base more advanced queries.You will learn how to properly use the Boolean operators

(AND, NOT, and OR) as well as exploring the power and flexibility of grouping searches.

We will also learn Google’s unique implementation of several different wildcard characters.

Finally, you will learn the syntax of Google’s Uniform Resource Locator (URL) structure.

Learning the ins and outs of the Google URL will give you access to greater speed and

flexibility when submitting a series of related Google searches.We will see that the Google

URL structure provides an excellent “shorthand” for exchanging interesting searches with

friends and colleagues.

Screenshot

Purchase Now !
Just with Paypal

Product details

Price
File Size	15,641 KB
Pages	561 p
File Type	PDF format
ISBN-13	978-1-59749-176-1
Copyright	2008 by Elsevier, Inc

Table of Contents

Chapter 1 Google Searching Basics . . . . . . . . . . . . . . . . . . . 1

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Exploring Google’s Web-based Interface . . . . . . . . . . . . . . . .2

Google’s Web Search Page . . . . . . . . . . . . . . . . . . . . . . . .2

Google Web Results Page . . . . . . . . . . . . . . . . . . . . . . . .4

Google Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6

Google Image Search . . . . . . . . . . . . . . . . . . . . . . . . . . .7

Google Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8

Language Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11

Building Google Queries . . . . . . . . . . . . . . . . . . . . . . . . . .13

The Golden Rules of Google Searching . . . . . . . . . . . . .13

Basic Searching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15

Using Boolean Operators and Special Characters . . . . . .16

Search Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Working With Google URLs . . . . . . . . . . . . . . . . . . . . . . .22

URL Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

Special Characters . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

Putting the Pieces Together . . . . . . . . . . . . . . . . . . . . . .24

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44

Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .46

Chapter 2 Advanced Operators . . . . . . . . . . . . . . . . . . . . . 49

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50

Operator Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51

Troubleshooting Your Syntax . . . . . . . . . . . . . . . . . . . . .52

Introducing Google’s Advanced Operators . . . . . . . . . . . . . .53

Intitle and Allintitle: Search Within the Title of a Page . .54

Allintext: Locate a String Within the Text of a Page . . . .57

Inurl and Allinurl: Finding Text in a URL . . . . . . . . . . .57

Site: Narrow Search to Specific Sites . . . . . . . . . . . . . . .59

Filetype: Search for Files of a Specific Type . . . . . . . . . . .61

Link: Search for Links to a Page . . . . . . . . . . . . . . . . . . .65

Inanchor: Locate Text Within Link Text . . . . . . . . . . . . .68

Cache: Show the Cached Version of a Page . . . . . . . . . .69

Numrange: Search for a Number . . . . . . . . . . . . . . . . . .69

Daterange: Search for Pages

Published Within a Certain Date Range . . . . . . . . . . . .70

Info: Show Google’s Summary Information . . . . . . . . . .71

Related: Show Related Sites . . . . . . . . . . . . . . . . . . . . .72

Author: Search Groups

for an Author of a Newsgroup Post . . . . . . . . . . . . . . . .72

Group: Search Group Titles . . . . . . . . . . . . . . . . . . . . . .75

Insubject: Search Google Groups Subject Lines . . . . . . . .75

Msgid: Locate a Group Post by Message ID . . . . . . . . . .76

Stocks: Search for Stock Information . . . . . . . . . . . . . . .77

Define: Show the Definition of a Term . . . . . . . . . . . . . .78

Phonebook: Search Phone Listings . . . . . . . . . . . . . . . . .79

Colliding Operators and Bad Search-Fu . . . . . . . . . . . . . . . .81

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86

Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .91

Chapter 3 Google Hacking Basics . . . . . . . . . . . . . . . . . . . 93

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94

Anonymity with Caches . . . . . . . . . . . . . . . . . . . . . . . . . . .94

Directory Listings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100

Locating Directory Listings . . . . . . . . . . . . . . . . . . . . .101

Finding Specific Directories . . . . . . . . . . . . . . . . . . . . .102

Finding Specific Files . . . . . . . . . . . . . . . . . . . . . . . . . .103

Server Versioning . . . . . . . . . . . . . . . . . . . . . . . . . . . .103

Going Out on a Limb:Traversal Techniques . . . . . . . . . . . .110

Directory Traversal . . . . . . . . . . . . . . . . . . . . . . . . . . . .110

Incremental Substitution . . . . . . . . . . . . . . . . . . . . . . .112

Extension Walking . . . . . . . . . . . . . . . . . . . . . . . . . . . .112

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116

Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .118

Chapter 4 Document Grinding and Database Digging . 121

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122

Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123

Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130

Office Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . .133

Database Digging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134

Login Portals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135

Support Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137

Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139

Database Dumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . .147

Actual Database Files . . . . . . . . . . . . . . . . . . . . . . . . . .149

Automated Grinding . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150

Google Desktop Search . . . . . . . . . . . . . . . . . . . . . . . . . . .153

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156

Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .158

Chapter 5 Google’s Part in an

Information Collection Framework . . . . . . . . . . . . . . . . . 161

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162

The Principles of Automating Searches . . . . . . . . . . . . . . .162

The Original Search Term . . . . . . . . . . . . . . . . . . . . . .165

Expanding Search Terms . . . . . . . . . . . . . . . . . . . . . . .166

E-mail Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . .166

Telephone Numbers . . . . . . . . . . . . . . . . . . . . . . . .168

People . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169

Getting Lots of Results . . . . . . . . . . . . . . . . . . . . . .170

More Combinations . . . . . . . . . . . . . . . . . . . . . . . .171

Using “Special” Operators . . . . . . . . . . . . . . . . . . . .172

Getting the Data From the Source . . . . . . . . . . . . . . . .173

Scraping it Yourself—Requesting

and Receiving Responses . . . . . . . . . . . . . . . . . . .173

Scraping it Yourself – The Butcher Shop . . . . . . . . .179

Dapper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184

Aura/EvilAPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184

Using Other Search Engines . . . . . . . . . . . . . . . . . .185

Parsing the Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186

Parsing E-mail Addresses . . . . . . . . . . . . . . . . . . . . .186

Domains and Sub-domains . . . . . . . . . . . . . . . . . . .190

Telephone Numbers . . . . . . . . . . . . . . . . . . . . . . . .191

Post Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193

Sorting Results by Relevance . . . . . . . . . . . . . . . . .193

Beyond Snippets . . . . . . . . . . . . . . . . . . . . . . . . . . .195

Presenting Results . . . . . . . . . . . . . . . . . . . . . . . . .196

Applications of Data Mining . . . . . . . . . . . . . . . . . . . . . . .196

Mildly Amusing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196

Most Interesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199

Taking It One Step Further . . . . . . . . . . . . . . . . .209

Collecting Search Terms . . . . . . . . . . . . . . . . . . . . . . . . . .212

On the Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212

Spying on Your Own . . . . . . . . . . . . . . . . . . . . . . . . . .214

Search Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214

Gmail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .217

Honey Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219

Referrals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222

Chapter 6 Locating Exploits and Finding Targets . . . . . 223

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224

Locating Exploit Code . . . . . . . . . . . . . . . . . . . . . . . . . . .224

Locating Public Exploit Sites . . . . . . . . . . . . . . . . . . . .224

Locating Exploits Via Common Code Strings . . . . . . . . . .226

Locating Code with Google Code Search . . . . . . . . . . . . .227

Locating Malware and Executables . . . . . . . . . . . . . . . . . . .230

Locating Vulnerable Targets . . . . . . . . . . . . . . . . . . . . . . . .234

Locating Targets Via Demonstration Pages . . . . . . . . . .235

Locating Targets Via Source Code . . . . . . . . . . . . . . . .238

Locating Targets Via CGI Scanning . . . . . . . . . . . . . . .257

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260

Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .261

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .262

Chapter 7 Ten Simple Security Searches That Work . . . 263

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .264

site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .264

intitle:index.of . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .265

error | warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .265

login | logon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .267

username | userid | employee.ID | “your username is” . . .268

password | passcode | “your password is” . . . . . . . . . . . . .268

admin | administrator . . . . . . . . . . . . . . . . . . . . . . . . . . .269

–ext:html –ext:htm –ext:shtml –ext:asp –ext:php . . . . . . . .271

inurl:temp | inurl:tmp | inurl:backup | inurl:bak . . . . . . . .275

intranet | help.desk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .275

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .277

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .277

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .279

Chapter 8 Tracking Down Web Servers,

Login Portals, and Network Hardware . . . . . . . . . . . . . . 281

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .282

Locating and Profiling Web Servers . . . . . . . . . . . . . . . . . .282

Directory Listings . . . . . . . . . . . . . . . . . . . . . . . . . . . .283

Web Server Software Error Messages . . . . . . . . . . . . . .284

Microsoft IIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . .284

Apache Web Server . . . . . . . . . . . . . . . . . . . . . . . . .288

Application Software Error Messages . . . . . . . . . . . . . .296

Default Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299

Default Documentation . . . . . . . . . . . . . . . . . . . . . . . .304

Sample Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . .307

Locating Login Portals . . . . . . . . . . . . . . . . . . . . . . . . . . .309

Using and Locating Various Web Utilities . . . . . . . . . . .321

Targeting Web-Enabled Network Devices . . . . . . . . . . . . .326

Locating Various Network Reports . . . . . . . . . . . . . . . . . .327

Locating Network Hardware . . . . . . . . . . . . . . . . . . . . . . .330

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .342

Chapter 9 Usernames, Passwords,

and Secret Stuff, Oh My! . . . . . . . . . . . . . . . . . . . . . . . . . 345

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346

Searching for Usernames . . . . . . . . . . . . . . . . . . . . . . . . . .346

Searching for Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . .352

Searching for Credit Card Numbers, Social Security Numbers, and

More . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .361

Social Security Numbers . . . . . . . . . . . . . . . . . . . . . . .363

Personal Financial Data . . . . . . . . . . . . . . . . . . . . . . . .363

Searching for Other Juicy Info . . . . . . . . . . . . . . . . . . . . . .365

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .369

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .369

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .370

Chapter 10 Hacking Google Services . . . . . . . . . . . . . . . 373

AJAX Search API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .374

Embedding Google AJAX Search API . . . . . . . . . . . . .375

Deeper into the AJAX Search . . . . . . . . . . . . . . . . . . .379

Hacking into the AJAX Search Engine . . . . . . . . . . . .384

Calendar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .389

Blogger and Google’s Blog Search . . . . . . . . . . . . . . . . . . .392

Google Splogger . . . . . . . . . . . . . . . . . . . . . . . . . . . . .393

Signaling Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .402

Google Co-op . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .404

Google AJAX Search API Integration . . . . . . . . . . . . .409

Google Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .410

Brief Introduction to SVN . . . . . . . . . . . . . . . . . . . . .411

Getting the files online . . . . . . . . . . . . . . . . . . . . . . . .412

Searching the Code . . . . . . . . . . . . . . . . . . . . . . . . . .414

Chapter 11 Google Hacking Showcase . . . . . . . . . . . . . . 419

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .420

Geek Stuff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .421

Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .421

Open Network Devices . . . . . . . . . . . . . . . . . . . . . . . .424

Open Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . .432

Cameras . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .438

Telco Gear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .446

Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .451

Sensitive Info . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .455

Police Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .461

Social Security Numbers . . . . . . . . . . . . . . . . . . . . . . . . . .464

Credit Card Information . . . . . . . . . . . . . . . . . . . . . . .469

Beyond Google . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .477

Chapter 12 Protecting Yourself from Google Hackers. . 479

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .480

A Good, Solid Security Policy . . . . . . . . . . . . . . . . . . . . . .480

Web Server Safeguards . . . . . . . . . . . . . . . . . . . . . . . . . . .481

Directory Listings and Missing Index Files . . . . . . . . . .481

Robots.txt: Preventing Caching . . . . . . . . . . . . . . . . . .482

NOARCHIVE:The Cache “Killer” . . . . . . . . . . . . . . .485

NOSNIPPET: Getting Rid of Snippets . . . . . . . . . . . .485

Password-Protection Mechanisms . . . . . . . . . . . . . . . . .485

Software Default Settings and Programs . . . . . . . . . . . .487

Hacking Your Own Site . . . . . . . . . . . . . . . . . . . . . . . . . .488

Site Yourself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .489

Gooscan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .489

Installing Gooscan . . . . . . . . . . . . . . . . . . . . . . . . .490

Gooscan’s Options . . . . . . . . . . . . . . . . . . . . . . . . .490

Gooscan’s Data Files . . . . . . . . . . . . . . . . . . . . . . . .492

Using Gooscan . . . . . . . . . . . . . . . . . . . . . . . . . . . .494

Windows Tools and the .NET Framework . . . . . . . . . .499

Athena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .500

Using Athena’s Config Files . . . . . . . . . . . . . . . . . . .502

Constructing Athena Config Files . . . . . . . . . . . . . .503

Wikto . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .505

Google Rower . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508

Google Site Indexer . . . . . . . . . . . . . . . . . . . . . . . . . . .510

Advanced Dork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512

Getting Help from Google . . . . . . . . . . . . . . . . . . . . . . . .515

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517

Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .518

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .519

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521

  ●▬▬▬▬▬❂❂❂▬▬▬▬▬●

●▬▬❂❂▬▬●

●▬❂▬●

●❂●

═════● ●═════