Advanced Google Advanced Google SearchingSearchingGoogle as a hacking toolGoogle as a hacking tool

Author: Johnny LongAuthor: Johnny Longjohnny@ihackstuff.com

http://johnny.ihackstuff.comhttp://johnny.ihackstuff.com

Speaker: Vicente AceitunoSpeaker: Vicente Aceituno

First Improvised Security Testing Conference

Madrid, 8th August 2003

Why Google?Why Google?

Google caches all crawled web pagesGoogle caches all crawled web pages Google provides instant responseGoogle provides instant response Google provides document translationsGoogle provides document translations Google provides language translationGoogle provides language translation Google provides web, news, catalog and Google provides web, news, catalog and

ftp searchesftp searches Google is coolGoogle is cool

IndexIndex

Google SearchingGoogle SearchingDefault Web pagesDefault Web pagesDirectory listingsDirectory listingsFinding filesFinding filesGooglescan toolsGooglescan toolsRise of the RobotsRise of the RobotsPreventionPrevention

Google SearchingGoogle Searching

Google provides a great deal of Google provides a great deal of information about using it’s search information about using it’s search engine in it’s fullest capacity.engine in it’s fullest capacity.

The following tables are copied verbatim The following tables are copied verbatim from Google’s usage documentsfrom Google’s usage documents

Basic SearchingBasic Searching

Special Query Capability

Example Query Description

Include Query Term

Star Wars Episode +I

If a common word is essential to getting the results you want, you can include it by putting a "+" sign in front of it. 

Exclude Query Term

bass -musicYou can exclude a word from your search by putting a

minus sign ("-") immediately in front of the term you want to exclude from the search results.

Phrase Search "yellow pages"

Search for complete phrases by enclosing them in quotation marks or connecting them with hyphens. Words marked in this way will appear together in all results exactly as entered.

Note: You may need to use a "+" to force inclusion of common words in a phrase.

Boolean OR Search

vacation london OR paris

Google search supports the Boolean "OR" operator. To retrieve pages that include either word A or word B, use an uppercase OR between terms.

Filtering/ExclusionFiltering/Exclusion

File Type FilteringGoogle filetype:doc OR

filetype:pdf

The query prefix "filetype:" filters the results returned to include only documents with the extension specified immediately after. Note there can be no space between "filetype:" and the specified extension.

Note: Multiple file types can be included in a filtered search by adding more "filetype:" terms to the search query.

File Type ExclusionGoogle -filetype:doc -

filetype:pdf

The query prefix "-filetype:" filters the results to exclude documents with the extension specified immediately after.  Note there can be no space between "-filetype:" and the specified extension.

Note: Multiple file types can be excluded in a filtered search by adding more "-filetype:" terms to the search query.

Filtering site/dateFiltering site/date

Site Restricted Search

admission site:www.stanford.edu

If you know the specific web site you want to search but aren’t sure where the information is located within that site, you can use Google to search only within a specific web site. 

Do this by entering your query followed by the string “site:” followed by the host name.

Note: The exclusion operator (“-“) can be applied to this query term to remove a web site from consideration in the search.Note: Only one site: term per query is supported.

Date Restricted Search

Star Wars daterange:2452122-2452234

If you want to limit your results to documents that were published within a specific date range, then you can use the “daterange: “ query term to accomplish this. The “daterange:” query term must be in the following format:

daterange:<start_date>-<end date> where<start_date> = Julian date indicating the start of

the date range<end_date> = Julian date indicating the end of the date range

The Julian date is calculated by the number of days since January 1, 4713 BC. For example, the Julian date for August 1, 2001 is 2452122.

Title searchingTitle searching

Title Search (term) intitle:Google search

If you prepend "intitle:" to a query term, Google search restricts the results to documents containing that word in the title. Note there can be no space between the "intitle:" and the following word. Note: Putting "intitle:" in front of every word in your query is equivalent to putting "allintitle:" at the front of your query.

Title Search (all) allintitle: Google searchStarting a query with the term "allintitle:" restricts the results to those with all of the query words in the title.

URL SearchesURL Searches

URL Search (term) inurl:Google search

If you prepend "inurl:" to a query term, Google search restricts the results to documents containing that word in the result URL. Note there can be no space between the "inurl:" and the following word.

Note:  "inurl:" works only on words , not URL components. In particular, it ignores punctuation and uses only the first word following the "inurl:" operator. To find multiple words in a result URL, use the "inurl:" operator for each word.

Note: Putting "inurl:" in front of every word in your query is equivalent to putting "allinurl:" at the front of your query.

URL Search (all) allinurl: Google search

Starting a query with the term "allinurl:" restricts the results to those with all of the query words in the result URL.

Note: "allinurl:" works only on words, not URL components. In particular, it ignores punctuation.  Thus, "allinurl: foo/bar" restricts the results to pages with the words "foo" and "bar" in the URL, but does not require that they be separated by a slash within that URL, that they be adjacent, or that they be in that particular word order. There is currently no way to enforce these constraints.

Text/Link SearchingText/Link Searching

Text Only Search (all)allintext: Google

search

Starting a query with the term “allintext:” restricts the results to those with all of the query words in only the body text, ignoring link, URL, and title matches.

Links Only Search (all)allinlinks: Google

search

Starting a query with the term “allinlinks:” restricts the results to those with all of the query words in the URL links on the page.

Link SearchesLink Searches

Back Links link:www.google.com 

The query prefix "link:" lists web pages that have links to the specified web page. Note there can be no space between "link:" and the web page URL.

Note: No other query terms can be specified when using this special query term.

Related Linksrelated:www.google.co

m 

The query prefix "related:" lists web pages that are similar to the specified web page. Note there can be no space between "link:" and the web page URL.

Note: No other query terms can be specified when using this special query term.

Translation serviceTranslation service

Google offers a very nice language translation

service.

TricksTricks

When When www.google.com is not available, try is not available, try www2.google.com or www3.google.com.www2.google.com or www3.google.com.

Reading the google’s cache can prevent filters Reading the google’s cache can prevent filters to know what page are you seeing.to know what page are you seeing.

You can get the same result we trick an You can get the same result we trick an english-to-english translation.english-to-english translation.http://translate.google.com/translate (main URL) (main URL)

?u=http://www.defcon.org&langpair=?u=http://www.defcon.org&langpair=en|enen|en (options)(options)

Intuitive Google Intuitive Google SearchesSearchesDefault Web PagesDefault Web Pages

Windows-based default Windows-based default serverserver

intitle:"Welcome to Windows 2000 Internet Services"

Windows-based default Windows-based default serverserver

intitle:"Under construction" "does not currently have"

Windows NT 4.0Windows NT 4.0

intitle:“Welcome to IIS 4.0"

OpenBSD/Apache OpenBSD/Apache (scalp=)(scalp=)

“powered by Apache” “powered by openbsd"

Apache 1.2.6Apache 1.2.6

Intitle:”Test Page for Apache” “It Worked!”

Apache 1.3.0 – 1.3.9Apache 1.3.0 – 1.3.9

Intitle:”Test Page for Apache” “It worked!” “this web site!”

Apache 1.3.11 - 1.3.26Apache 1.3.11 - 1.3.26

"seeing this instead" intitle:"Test Page for Apache"

Apache 2.0Apache 2.0

Intitle:”Simple page for Apache” “Apache Hook Functions”

Apache Version InfoApache Version InfoApache Version

Number of Servers

1.3.6 119,000.00

1.3.3 151,000.00

1.3.14 159,000.00

1.3.24 171,000.00

1.3.9 203,000.00

2.0.39 256,000.00

1.3.23 259,000.00

1.3.19 260,000.00

1.3.12 300,000.00

1.3.20 353,000.00

1.3.22 495,000.00

1.3.26 896,000.00

Google told us all this. We’ll discuss how in the next section.

Intuitive SearchesIntuitive Searches

Directory ListingsDirectory Listings

Directory ListingsDirectory Listings

Directory listings are often misconfigurations in Directory listings are often misconfigurations in the web server.the web server.

A directory listing shows a list of files in a A directory listing shows a list of files in a directory as opposed to presenting a web directory as opposed to presenting a web page.page.

Directory listings can provide very useful Directory listings can provide very useful information.information.

Directory ExampleDirectory Example

Intitle:”Index of”

This query serves as the basis for all directory searches…

Directory Info GatheringDirectory Info Gathering

Some servers, like Apache, generate a server version tag.

Esoteric Apache VersioningEsoteric Apache Versioning

Esoteric Apache Versions found on Googlequery: intitle:"Index of" "Apache/[ver] Server at"

310

27,300

5

60,500

69,300

74 61 3 9 20 2 1,130 474

62,900

9,400

73933 30 207 932451,120

65,00064,200

45,200

01000020000300004000050000600007000080000

1.2

.6

1.3

b6

1.3

.0

1.3

.1

1.3

.2

1.3

.4-d

ev

1.3

.4

1.3

.7-d

ev

1.3

.11

1.3

.15

-de

v

1.3

.17

1.3

.17

-HO

F

1.3

.21

-de

v

1.3

.23

-de

v

1.3

.24

-de

v

1.3

.26

+in

ters

erv

er

1.3

.xx

2.0

.16

2.0

.18

2.0

.28

2.0

.32

2.0

.35

2.0

.36

2.0

.37

-de

v

2.0

.40

-de

v

A p a c h e V e r s i o n

Nu

mb

er o

f S

erve

rs

Common Apache VersioningCommon Apache Versioning

Common Apache Versions found on Googlequery: intitle:"Index of" "Apache/[ver] Server at"

159.000

260.000353.000

495.000

259.000171.000

896.000

256.000

119.000151.000 203.000

300.000

0,00

200.000,00

400.000,00

600.000,00

800.000,00

1.000.000,001

.3.1

2

1.3

.14

1.3

.19

1.3

.20

1.3

.22

1.3

.23

1.3

.24

1.3

.26

1.3

.3

1.3

.6

1.3

.9

2.0

.39

Apache Server Version

Nu

mb

er

of

Se

rve

rs

Intuitive SearchesIntuitive Searches

Finding FilesFinding Files

test-cgitest-cgi

Intitle:”Index of” test-cgi

ws_ftp.logws_ftp.log

Intitle:”Index of” ws_ftp.log

Secring.pgpSecring.pgp

Intitle:”Index of” secring.php

config.phpconfig.php

Intitle:”Index of” config.php

administrators.pwdadministrators.pwd

Intitle:”Index of” administrators.pwd

ws_ftp.iniws_ftp.ini

Intitle:”Index of” ws_ftp.ini

Tip: Got to http://www.hispasec.com/directorio/laboratorio/Software/ws_ftp.html

.htpasswd.htpasswd

Intitle:”Index of” .htpasswd

.htpasswd.htpasswd

Intitle:”Index of” .htpasswd

/etc/shadow/etc/shadow

Intitle:”Index of” etc shadow

Advanced TechniquesAdvanced Techniques

GooglescanGooglescan

GooglescanGooglescan

With a known set of file-based web With a known set of file-based web vulnerabilities, a vulnerability scanner vulnerabilities, a vulnerability scanner based on search engines is certainly a based on search engines is certainly a reality.reality.

GooglescanGooglescan…/scancfg.cgi/cgi-bin/CrazyWWWBoard.cgi/cgi-bin/pals-cgi/ROADS/cgi-bin/search.pl/way-board/way-board.cgi/cgi-bin/replicator/webpage.cgi/cgi-bin/auktion.pl/cgi-bin/webspirs.cgi/cgi-bin/ipf/etc/gfw/ui/pwd.dat/cgi-bin/hsx.cgi/cgi-bin/mailnews.cgi/cgi-bin/adcycle/cgi-bin/post-query/cgi-bin/ikonboard/help.cgi/cgi-bin/webspirs.cgi…

Armed with a list of cgi exploits from any common CGI scanner…

Googlescan.shGooglescan.sh

rm tempawk -F"/" '{print $NF"|http://www.google.com/search?q= intitle%3A%22Index+of%22+"$NF}' vuln_files > queries

for query in `cat queries`do echo -n $query"|" >> temp echo $query | awk -F"|" '{print $2}' lynx -source `echo $query | awk -F"|" '{print $2}'` | grep "of about" | awk -F "of about" '{print $2}' | awk -F"." '{print $1}' | tr -d "</b>[:cntrl:] " >> temp echo " " >> tempDone

cat temp | awk -F"|" '{print "<A HREF=\"" $2 "\">" $1 " (" $3 "hits) </A><BR><BR>"}' | grep -v "(1,770,000" > report.html

Googlescan.shGooglescan.sh

A simple shell script presents an html-A simple shell script presents an html-formatted list of potentially vulnerable or formatted list of potentially vulnerable or interesting web servers.interesting web servers.

Googlescan.sh outputGooglescan.sh output

Niktoogle.exe outputNiktoogle.exe output

http://johnny.ihackstuff.com/googledorks.shtml

Advanced TechniquesAdvanced Techniques

Rise of the RobotsRise of the Robots

Rise of the RobotsRise of the Robots

Michal Zalewski wrote a great article for Michal Zalewski wrote a great article for Phrack (57/10) which presented the idea Phrack (57/10) which presented the idea of the use of autonomous search robots of the use of autonomous search robots in server exploitationin server exploitation

Rise of the RobotsRise of the Robots

“Consider a remote exploit that is able to compromise a remote system without sending any attack code to his victim. Consider an exploit which simply creates local file to compromise thousands of computers, and which does not involve any local resources in the attack. Welcome to the world of zero-effort exploit techniques. Welcome to the world of automation, welcome to the world of anonymous, dramatically difficult to stop attacks resulting from increasing Internet complexity.” –Michal Zalewski

The ConceptThe Concept

Web robots crawl a web page indexing files it is Web robots crawl a web page indexing files it is allowed to find.allowed to find.

Any links that are found on the indexed pages Any links that are found on the indexed pages are followed as well.are followed as well.

Instead of standard web links, create a payload Instead of standard web links, create a payload of “exploit” links for the crawlers to consume.of “exploit” links for the crawlers to consume.

Simple ExampleSimple Example

Michal presents the following example links on his Michal presents the following example links on his indexed web page:indexed web page:

http://somehost/cgi-bin/script.pl?p1=../../../../attackhttp://somehost/cgi-bin/script.pl?p1=../../../../attack http://somehost/cgi-bin/script.pl?p1=;attackhttp://somehost/cgi-bin/script.pl?p1=;attack http://somehost/cgi-bin/script.pl?p1=|attackhttp://somehost/cgi-bin/script.pl?p1=|attack http://somehost/cgi-bin/script.pl?p1=`attack`http://somehost/cgi-bin/script.pl?p1=`attack` http://somehost/cgi-bin/script.pl?p1=$(attack)http://somehost/cgi-bin/script.pl?p1=$(attack) http://somehost:54321/attack?`id`http://somehost:54321/attack?`id` http://somehost/AAAAAAAAAAAAAAAAAAAAA...http://somehost/AAAAAAAAAAAAAAAAAAAAA...

Simple ExampleSimple Example

The robots followed all the links as The robots followed all the links as written, including connecting to non-http written, including connecting to non-http ports.ports.

The robots followed the “attack links,” The robots followed the “attack links,” performing the attack completely performing the attack completely unaware.unaware.

Think BigThink Big

Michael goes on to postulate that randomly Michael goes on to postulate that randomly generated, massive lists would cause much generated, massive lists would cause much more of a problem.more of a problem.

A simple PERL or CGI script randomly A simple PERL or CGI script randomly generating attack links in the thousands and generating attack links in the thousands and teens of thousands would create a huge teens of thousands would create a huge problem!problem!

Who would be liable?Who would be liable?

Google doesn’t stopGoogle doesn’t stop

Tomorrow there will be even more sofisticated Tomorrow there will be even more sofisticated features…try this:features…try this:

http://labs1.google.com/cgi-bin/http://labs1.google.com/cgi-bin/gviewergviewer.cgi?q=.cgi?q=intitleintitle%3Aindex.of.private&delay=8&start=0%3Aindex.of.private&delay=8&start=0

http://labs.google.com/sets?hl=en&q1=passworhttp://labs.google.com/sets?hl=en&q1=password&q2=d&q2=passwdpasswd&q3=shadow&q4=etc&q5=&&q3=shadow&q4=etc&q5=&btnbtn=Large+Set=Large+Set

PreventionPrevention

Locking it downLocking it down

AdviceAdvice

Google says it isn’t Google’s fault. Google says it isn’t Google’s fault. Google is very happy to remove Google is very happy to remove

references. See references. See http://www.google.com/remove.html.http://www.google.com/remove.html.

Follow the webmaster’s advice found at Follow the webmaster’s advice found at http://www.google.com/webmasters/http://www.google.com/webmasters/

Get smarter.Get smarter.

/misc: “Google Hacks”/misc: “Google Hacks”

There is this book. And it’s an O’REILLY book.But it’s not about hacking.It’s about searching.

Google HotspotsGoogle Hotspots

Google APIs: Google APIs: http://www.google.com/apis/http://www.google.com/apis/

Google voice search: Google voice search: http://labs.http://labs.googlegoogle.com/.com/gvsgvs.html.html

Google sets: Google sets: http://labs.http://labs.googlegoogle.com/sets.com/sets Google catalog search: Google catalog search: http://catalogs.http://catalogs.googlegoogle

.com/.com/ Google news search: Google news search: http://news.http://news.googlegoogle.com.com Google weblog: Google weblog: http://http://googlegoogle..blogspaceblogspace.com/.com/

EOFEOF

Watch googleDorks.Watch googleDorks. Questions?Questions?