It's time for the 6th demo. Let me
show you how you can use Google hacking to
find insecure HTTP web pages.
The web application is hosted on the domain hacking
web applications.com.
I want to check if Google indexed insecure
HTTP web pages in this
web application.
For this purpose. I will use the following Google
search engine query.
site hacking web applications.com
and minus sign in
URL https
The queries starts with site hacking web
applications Comm because the web application
is hosted on this domain.
Next you can see the logical operator and
after The Logical
operator and there is minus sign
in URL https.
This way I am asking Google to return
index the web pages that are
not protected by secure https.
In other words, I am asking Google to return
indexed web pages that
are available over insecure http.
Okay. Now you understand how this
Google search engine query works.
So let me copy this query.
Let me paste it in Google search and let's
see if Google indexed web
pages available over insecure HTTP
on the domain hacking web
applications.com.
Please notice that one insecure HTTP
web page has been indexed by
Google.
Let's see this web page.
There is an HTML form
with sensitive data and the sensitive
data is as follows.
full name email phone and
password
What's more in the URL bar? You
can see a padlock crossed out
with a red line and it means that
this web page is available over insecure
http.
That's why the sensitive data entered into
this HTML form will be
sent over insecure HTTP, which
is just plain text. And obviously this
is not good from security point of
view.
So as you can see Google hacking can
help you find insecure HTTP web
pages and this is what I presented
to you in this demo.
Okay.
Now we are done with this demo. So let
me jump to the next clip and let me
tell you about Google hacking database.