Google Hacking for Penetration Testers

Bill Gardner, Johnny Long, Justin Brown

• Publisher: Syngress
• Year: 2011
• ISBN:
  9780080484266
• Topic: Informatique
• Subtopic: Cybersécurité

This book helps people find sensitive information on the Web.Google is one of the 5 most popular sites on the internet with more than 380 million unique users per month (Nielsen/NetRatings 8/05). But, Google's search capabilities are so powerful, they sometimes discover content that no one ever intended to be publicly available on the Web including: social security numbers, credit card numbers, trade secrets, and federally classified documents. Google Hacking for Penetration Testers Volume 2 shows the art of manipulating Google used by security professionals and system administrators to find this sensitive information and "self-police" their own organizations.Readers will learn how Google Maps and Google Earth provide pinpoint military accuracy, see how bad guys can manipulate Google to create super worms, and see how they can "mash up" Google with MySpace, LinkedIn, and more for passive reconaissance.• Learn Google Searching Basics
Explore Google's Web-based Interface, build Google queries, and work with Google URLs.
• Use Advanced Operators to Perform Advanced Queries
Combine advanced operators and learn about colliding operators and bad search-fu.
• Learn the Ways of the Google Hacker
See how to use caches for anonymity and review directory listings and traversal techniques.
• Review Document Grinding and Database Digging
See the ways to use Google to locate documents and then search within the documents to locate information.
• Understand Google's Part in an Information Collection Framework
Learn the principles of automating searches and the applications of data mining.
• Locate Exploits and Finding Targets
Locate exploit code and then vulnerable targets.
• See Ten Simple Security Searches
Learn a few searches that give good results just about every time and are good for a security assessment.
• Track Down Web Servers
Locate and profile web servers, login portals, network hardware and utilities.
• See How Bad Guys Troll for Data
Find ways to search for usernames, passwords, credit card numbers, social security numbers, and other juicy information.
• Hack Google Services
Learn more about the AJAX Search API, Calendar, Blogger, Blog Search, and more.

Chapter 1Google Searching Basics

Solutions in this chapter:

• 
  Exploring Google’s Web-based Interface
• 
  Building Google Queries
• 
  Working With Google URLs

Summary

Solutions Fast Track

Frequently Asked Questions

Introduction

Google’s Web interface is unmistakable. Its “look and feel” is copyright-protected, and for good reason. It is clean and simple. What most people fail to realize is that the interface is also extremely powerful. Throughout this book, we will see how you can use Google to uncover truly amazing things. However, as in most things in life, before you can run, you must learn to walk.

This chapter takes a look at the basics of Google searching. We begin by exploring the powerful Web-based interface that has made Google a household word. Even the most advanced Google users still rely on the Web-based interface for the majority of their day-today queries. Once we understand how to navigate and interpret the results from the various interfaces, we will explore basic search techniques.

Understanding basic search techniques will help us build a firm foundation on which to base more advanced queries. You will learn how to properly use the Boolean operators (AND, NOT, and OR) as well as exploring the power and flexibility of grouping searches. We will also learn Google’s unique implementation of several different wildcard characters.

Finally, you will learn the syntax of Google’s Uniform Resource Locator (URL) structure. Learning the ins and outs of the Google URL will give you access to greater speed and flexibility when submitting a series of related Google searches. We will see that the Google URL structure provides an excellent “shorthand” for exchanging interesting searches with friends and colleagues.

Exploring Google’s Web-based Interface

Google’s Web Search Page

The main Google Web page, shown in Figure 1.1, can be found at www.google.com. The interface is known for its clean lines, pleasingly uncluttered feel, and friendly interface. Although the interface might seem relatively featureless at first glance, we will see that many different search functions can be performed right from this first page.

As shown in Figure 1.1, there’s only one place to type. This is the search field. In order to ask Google a question or query, you simply type what you’re looking for and either press Enter (if your browser supports it) or click the Google Search button to be taken to the results page for your query.

Figure 1-1. The Main Google Web Page

The links at the top of the screen (Web, Images, Video, and so on) open the other search areas shown in Table 1.1. The basic search functionality of each section is the same: each search area of the Google Web interface has different capabilities and accepts different search operators, as we will see in Chapter 2. For example, the author operator works well in Google Groups, but may fail in other search areas. Table 1.1 outlines the functionality of each distinct area of the main Google Web page.

Table 1.1 The Links and Functions of Google’s Main Page

Interface Section	Description
The Google toolbar	The browser I am using has a Google “toolbar” installed and presented next to the address bar. We will take a look at various Google toolbars in the next section.
Web, Images, Video, News, Maps, Gmail and more tabs	These tabs allow you to search Web pages, photographs, message group postings, Google maps, and Google Mail, respectively. If you are a first-time Google user, understand that these tabs are not always a replacement for the Submit Search button. These tabs simpl...

Table of contents

• Cover
• Title Page
• Copyright
• Acknowledgments
• Lead Author
• Contributing Authors
• Table of Contents
• Chapter 1: Google Searching Basics
• Chapter 2: Advanced Operators
• Chapter 3: Google Hacking Basics
• Chapter 4: Document Grinding and Database Digging
• Chapter 5: Google's Part in an Information Collection Framework
• Chapter 6: Locating Exploits and Finding Targets
• Chapter 7: Ten Simple Security Searches That Work
• Chapter 8: Tracking Down Web Servers, Login Portals, and Network Hardware
• Chapter 9: Usernames, Passwords, and Secret Stuff, Oh My!
• Chapter 10: Hacking Google Services
• Chapter 11: Google Hacking Showcase
• Chapter 12: Protecting Yourself from Google Hackers
• Index
• Instructions for online access