Google Hacking for Penetration Testers

Corey Nachreiner writes "Until recently, I considered myself a Google power-user; so much so that I often call Google my "second brain." Whenever I stumble upon a computing dilemma I can't solve, I submit an advanced query to my second brain, Google, and let it supply the answers. That's why I was So There when Johnny Long released his recent book, Google Hacking for Penetration Testers . I heard Johnny's lively, light-hearted presentation to a packed house at the BlackHat Briefings last summer in Las Vegas. It was the hit of the show, but in one hour he could only present a few of his startling findings about Google hacking. After reading Johnny's book, I've learned a ton more and realized I wasn't quite as Google-savvy as I thought. As with my real brain, I've only been using about ten percent of my Google-brain's capacity." Read on for the rest of Nachreiner's review.

Google Hacking for Penetration Testers
author	Johnny Long
pages	448
publisher	Syngress
rating	8
reviewer	Corey Nachreiner
ISBN	1931836361
summary	Google's dark and dork sides exposed; despite the title, useful for everyone who'd like to get the most out of google.

According to its cover, Johnny Long's book focuses primarily on revealing the "Dark Side" of Google -- a promise it delivers in spades. But I can also heartily recommend Google Hacking to newbies who simply want to learn how to harness Google's full potential.

The first few chapters of the book walk you through Google's interfaces and features, then introduce you to Google's advanced operators and techniques you can use to refine your Google searches. Instead of submitting basic searches that leave you arduously parsing hundreds of results for your desired answer, you quickly learn to submit powerful queries that almost instantly yield the results you intend. Even as an experienced Google user, I learned a lot from Google Hacking's early chapters. For Google neophytes, this alone makes the book worth its price.

However, we all know Slashdotters really want this book in order to learn how hackers misuse Google. Well, you won't be disappointed. As soon as Long has taught you to submit advanced queries, he wastes no time in showing you the techniques l33t Google hax0rs use to exploit the search engine's power. For example, did you know you can use Google as a free proxy server? By submitting a specially-crafted, English-to-English translation query, you can capitalize on Google's translation service to anonymously submit all your Web requests. This simple hack just scratches the surface of Google's malicious potential.

Most Web surfers don't realize the sheer amount of extremely sensitive information available for the harvesting on the Internet. In that sense, Google Hacking is eye-popping. Do you want to find misconfigured Web servers that publicly list their directory contents? A quick Google search does the trick. Or, suppose you found some new exploit code that only works against a particular version of IIS 5.0. Submit a quick Google query for a helpful list of possible targets. Do you want to harvest user logins, passwords (for example, mySQL passwords in a connect.inc file), credit card numbers, social security numbers or any other potentially damaging tidbit that Web users and administrators accidentally leak onto the Internet? Google Hacking shows you how, with highly refined searches gleaned from the community contributing to the Google Hacking database (GHDB) found on Long's Web site.

While Long's book discloses these and many other potentially malicious Google searching techniques, it does so responsibly, with the goal of prevention in mind. Only the less damaging search strings are fully revealed. Long saves the juicier (read: more dangerous) hacks for your own discovery. Long even obfuscates the sensitive results of the more damaging search strings in order to protect the innocent incompetents he refers to as "googledorks." After showing you how hackers subvert Google to their malicious intent, Long dedicates a chapter to how Web administrators can configure their Web servers securely in order to prevent sensitive data from making it into a Google Hacker's clutches.

Though I've gushed about the book so far, I will quibble with its inconsistent tone. Some of its chapters target readers having different levels of technical understanding. While the book starts out in a voice easy enough for even the most novice user to understand, some of the later chapters, on topics such as document grinding, database digging, and query automation, jump drastically and use language and techniques that only programmers or Unix power-users would understand. In addition, the humor that made Johnny's live presentation so memorable shows up in his book, but in scant supply; frankly, more jokes would be welcome.

But these negatives are mere nits. Whether you're a penetration tester wanting to exploit Google, a Web administrator wanting to protect yourself from information leaks, or even a newbie wanting to harness Google's full potential, Google Hacking for Penetration Testers makes an excellent resource. If you, too, use Google as a second brain, pick up Johnny Long's book and learn how to exploit this powerful search engine to its full capacity.

---

Corey Nachreiner, Network Security Analyst for WatchGuard's LiveSecurity Service, writes about network security on the free RSS news feed, WatchGuard Wire (browsable version, RSS feed.) You can purchase Google Hacking for Penetration Testers from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

This is ironic

[955301]

One of the first links I checked out from the google results he lists is apparantly some ddos [dc.spec.pl] perpetrator's weapons list page.

Go Figure.

GeoCamming

[Schrockwell]

Here [hackaday.com] is a cool article on Hackaday that describes GeoCamming, another Google exploit.
I like to find interesting cameras and then use NeoTrace [neotrace.com] to trace the addresses to find out exactly where the camera is. It's quite fun.

Re:Nice website

[maotx]

Wow. I hope you know you just FUBAR'd someones webserver. awesome.

If you say so. The Samba server exploit only returns one result (which is at members.lycos mind you), the hidden portals are in public domain, and as for the sensitive files bit: it's out there on the Internet anyway (as in public information). It is one thing to hand over the keys to a server (exploit research required), it's another to hand out public information.

Re:I wanna be a tester

[pete6677]

Considering how male dominated the computer field is, I'd say they'd be mostly dudes. I'll take a pass on this job.

another article

[zanthas]

The register had a mirrored [theregister.co.uk] article from security focus. It walks you through the basic idea behind the book.

Re:Nice website

[ruvreve]

It's not free, but it's cheap (as in beer) and automated (as in no hands required)

http://www.pornsnatcher.com/

Re:amazon link

[Anonymous Coward]

I posted the link and I wasn't looking to make a buck. The link is not tied into any affiliate program. Even though the link could be misconstrued as an affiliate, at least it didn't produce a 404.

Re:amazon link

[Anonymous Coward]

Why don't you get a life instead of trying to ruin some guy's day of making a little bit of money?

It doesn't cost anyone else extra to buy it referred and it was helpful to people who fucking wanted to book

You jackoff

crazy!

[kreativemind]

These hacks are just the beginning and i can't wait to see how far Google will allow such queries to go on. I probably think that Google will limit special or *hacking technique queries search anytime soon, if not expect big brother or corporate giants to interfere with search engines and take actions against these small but powerful methods of hacking thru 'search engines'.