Google Hacking for Penetration Testers - Black Hat | Home PDF
Preview Google Hacking for Penetration Testers - Black Hat | Home
Google Hacking for Penetration Testers Using Google as a Security Testing Tool Johnny Long [email protected] What we’re doing • I hate pimpin’, but we’re covering many techniques covered in the “Google Hacking” book. • For much more detail, I encourage you to check out “Google Hacking for Penetration Testers” by Syngress Publishing. Advanced Operators Before we can walk, we must run. In Google’s terms this means understanding advanced operators. Advanced Operators • Google advanced operators help refine searches. • They are included as part of a standard Google query. • Advanced operators use a syntax such as the following: operator:search_term • There’s no space between the operator, the colon, and the search term! Advanced Operators at a Glance Some operators can only be used to Operator Purpose Mixes with Can be Does search work in search other used Advanced operators? alone? Web Images Groups News specific operators areas of intitle Search page yes yes yes yes yes yes can be title Google, as allintitle Search page no yes yes yes yes yes combined title these inurl Search URL yes yes yes yes not like intitle in some columns really cases. allinurl Search URL no yes yes yes yes like intitle show. filetype Search yes no yes yes no not really specific files allintext Search text of not really yes yes yes yes yes page only site Search yes yes yes yes no not really specific site link Search for no yes yes no no not really In other links to pages inanchor Search link yes yes yes yes not yes cases, anchor text really numrange Locate yes yes yes no no not really mixing number should be daterange Search in yes no yes not not not really date range really really avoided. author Group author yes yes no no yes not really search group Group name not really yes no no yes not really search insubject Group subject yes yes like like yes like intitle search intitle intitle msgid Group msgid no yes not not yes not really search really really Crash course in advanced operators Some operators search overlapping areas. Consider site, inurl and filetype. SITE: INURL: FILETYPE: Inurl can search the Filetype can only search file Site can not whole URL, including extension, which may be hard to search port. port and filetype. distinguish in long URLs. Advanced Google Searching intitle:”I hack stuff” There are filetype:php many ways to find the same page. These individual queries could all help find the same page. intext:navigate numrange:99999-100000 Advanced Google Searching Put those individual queries together into one monster query and you only get that one specific result. Adding advanced reduces operators the number of results focus adding to the search. Google Hacking Basics Putting operators together in intelligent ways can cause a seemingly innocuous query… INURL:admin INURL:orders FILETYPE:php Google Hacking Basics …can return devastating results! Customer names Order Amounts Payment details!
Description:The list of books you might like
