While the search engines are the most typical examples of crawlers and they let us run queries on the
websites, search engines are very useful to collect information about the target in depth.
Using search engines, you can find enormous pieces of useful information about the target company,
names of the employees, accessible services of the systems, files or folders which contain sensitive
data login pages beyond the known weaknesses.
These leave traces on the website, on headers titles.
You are URLs.
You can easily find these traces using search engines.
Google Hacking, also named Google Dorking, is a computer hacking technique that uses Google search
and other Google applications to find security holes in the configuration and computer code that websites
use.
Google hacking involves using advanced operators in the Google search engine to locate specific strings
of text within search results.
Some of the more popular examples are finding specific versions of vulnerable Web applications.
Some of the advanced operators of Google's search engines are shown in the slide.
You can see the details of advanced search in Google at Google dot com slash advanced underscore search.
You can find a lot of specific queries on Exploit Dash SDB dotcoms.
Google hyphen dorks.
Using these queries, you can discover Web application of vulnerabilities, files containing username
and or passwords, sensitive folders, Web services, error messages that disclose sensitive information,
log or backup files, devices such as printers or CCTV cameras that are accessible over the net and
more.
For example, you can find a username and password list from front page servers by writing the keyword
shown on the slide in the Google search field.
Here, there are a few examples to show how we can use Google advanced search to find valuable information.
For example, if we do a search with the words in Utero SEO geoduck and in utero colon admen, we can
find administrative panels of the websites which have kode UK Super Domain, originally created by Johnny
Long of Hackers for Charity.
The Google Hacking Database SDB is an authoritative source for querying the ever widening reach of the
Google search engine.
In the HDB, you'll find search terms for files containing usernames, vulnerable servers and even files
containing passwords.
When the Google hacking database was integrated in the exploit database of offensive security, the
various Google Docs contained in the thousands of exploit entries were entered into the SDB.
The direct mapping allows penetration testers to more rapidly determine if a particular Web application
has a publicly available exploit.