Now let's talk about Google Hacking database.
Google hacking database contains bunch of search operators that we have learned from previous lectures
that are intended to find some juicy and sensitive information so we can find vulnerable servers, passwords,
usernames, everything we could imagine.
In this example, I would like to show you how Google Hacking database could be used to find some public
cameras.
So I'm going to go to the search and search for camera.
And then I'm going to go to the next page and copy this dork.
And then I'll go to google.com and add this search operator, which is something that is very simple
and we've learned from previous lectures.
So there are many links that will allow you to see some live videos.
So let me open this one for example, and this one and this one.
So as you can see here, we can see a live video camera.
And the crazy thing about that is that we didn't need to use any login credentials.
Now, please keep in mind that if you were able to find a camera or a server or an IoT device and this
device asks you for a username and password, even if they are using the default credentials, you are
not allowed to enter the login credentials and login because you are not authorized and you do not have
permission to do this.
But in this case, we are looking at a camera that did not ask us to enter any login credentials.
Here is another Google doc that will allow you to find pictures that are hosted on an Android device.
So I'm going to hit enter.
And you can see that we were able to find an Android device.
If we open the URL, we can see that there are MP4 files that we can download and watch, and we can
also find some pictures.
We can also go to the parent directory and see if there is anything else.
We can see that we can access books, applications, or what I'm going to do is to analyze one of these
pictures and see if they contain any metadata.
And metadata are information that are embedded in an MP4 file, or a picture that tells you more about
the image.
For example, what phone took the image at which time?
And sometimes you'll be able to find the coordinates of the image.
So let's do an example.
I'm going to copy the link of this image, and then I'm going to go to Google and search for Exiftool.
And open the first website.
And in Exiftool is a tool that will extract metadata from PDF files, images and videos.
We can go to this field and add the link of the image and then click on get URL.
So here are the information that we were able to find about this image.
Here we can see that it were taken from a Samsung phone.
We can see the camera model name and the software that were used, and the modify date and the creation
date, etc. and sometimes you will be able to find the coordinates of this image, which will tell you
where exactly the image has been taken.