Slashdot Mirror

Google can dig up all kinds of wonderful information.

Hmm, I wonder if it's going to be something like this...?
http://johnny.ihackstuff.com/ghdb.php

We can google for these?

Someone has done pretty well out of the normal Google engine for this kind of "research".

JIHS comes to mind.

I saw in TFA that they tryed to use anonymiser, but since its host is well know it is often blocked.

Has anyone tryed using the old CGI Proxy Trick on this one?

this offers several options, though i dont know if someone who could confirm this would read /.

"Google Hacking" isn't a book, it's a web site.

Actually, it's both.
The Book
The website

Like it said in the review, they called the book "Google Hacking" for short.

"Google Hacking" isn't a book, it's a web site.

Those who haven't checked out the site, will find the Google Hacking Database (GHDB) very interesting and somewhat scary. The things people put online and the security of certain systems is mind-boggling.

"Google Hacking" isn't a book, it's a web site.

Those who haven't checked out the site, will find the Google Hacking Database (GHDB) very interesting and somewhat scary. The things people put online and the security of certain systems is mind-boggling.

Right now the server is undergoing some severe penetration testing, and from the looks of it, not doing too well...

Personally I've been using his site for a while now. It is great site with user submitted hacks and a community review. It really is amazing what is on Google and knew a book was coming to exploit it.
Besides being able to find sensitive files, hidden portals, and vulnerable servers, it is also a good way to get free porn.

The exploits are just really advanced searches like the one below.

"http://*:*@www"bangbus

lots of places have this problem, have a look at
http://johnny.ihackstuff.com/index.php?module=prod reviews&func=reviewsbycat&reviewsel=18

"Who's johnny? ...... Secondly, I am a family guy. I am very close to my family and make them the second-highest priority in my life." http://johnny.ihackstuff.com/modules.php?op=modloa d&name=FAQ&file=index&myfaq=yes&id_cat=1 I'm sure he's a guy?

...let j0hnny do all the work for me.

I mean with the 0 in his name and everything, I know he's good.

I guess a lot of people have seen this site before, but http://johnny.ihackstuff.com/index.php?module=prod reviews has a lot of these google exploits etc, he is posting them up so people can check if their sites are secure. There are some interesting presentations by him on the main site about how search engines can be exploited.

Like Google?

Google hacks.

inurl:"view/index.shtml"

see http://johnny.ihackstuff.com/ for the "Google Hacking Database" (seems to be down at the moment).

The difference with Google (and all other legal sites, as far as I know) is that if asked, they will remove an illegal or infringing link.

I'd rather say the difference lies in the intent. Google really caches a LOT, including credentials on broken webservers. Take a look at the Google Hacking Database for instance: http://johnny.ihackstuff.com/index.php?module=prod reviews

It make little sense IMHO to go after sites/search engines/whatever that blindly caches and indexes stuff, while it make a lot of sense to go after sites that deliberately uses loopholes to help software piracy.

Remember Google-hacks at http://johnny.ihackstuff.com/? Basically, since Google effectively snoops millions of servers, you can use this information to break into servers and get information. Having an internal feature that connects broken links to real pages may be orders of magnitudes worse. What if I imaginatively "linked" to a made-up URL to see what's on your servers? This could be bad news if it's effectively done.

Yes

Depending on the setup there are many ways to get access to the printers.

All google needs is one link.

fun with google

"It lets you enter keywords in the browser address bar, and when Google decides this is a sure bet you will be directly forwarded to the right page."

Google hacking will be really damn funny. Just imagine, say, for 6 months, people get used to typing 'update windows' in their address bar. Then, some google hacker figures out a way to suddenly spike the value of some other site somehow to include 'update windows' as the first choice. Hopefully not to goatse.

other fun things to do with google

Now that M$ is all over the place with trying to find a "Google remedy", the dropping of the WinFS from the upcoming Longhorn (as if it was really "upcoming"...), Google seems like it is twisting the knife when highly skilled (I hope) hackers will come up with new ways to expand the capabilities/uses of the "G"...

Watch out M$ - here we come...

OTOH - It might just end up with a neater way to Googlehack more funny data out of the web (http://johnny.ihackstuff.com/)

get a free ipod! This really works... And... GMail invites to the next 4 to hop in... (1 invite already sent...)

try typing
intitle:index.of mp3 coldplay

things like cv.doc also give realy emberrasing results as still 4,770,000 sites still give nice browsable results.....

See http://johnny.ihackstuff.com/ for details

A security focus article with many other ideas and a complete web site about google hacking. Happy searching :)

This has been fairly known and Johnny had great presentations in the last Blackhat and DefCon that really shook you up if you were not aware of the "Power of G"...

Very cool, a lot of very stupid people (from the myPHPAdmin, to the WebDAV-Frontpage passwords, all the way to nessus and ISS scan results...).

get a free ipod! This really works. (Free gmail invite to the ones using this referal and completing the offer!)

This was on bugtraq a week or two ago:

Check it out and there was a discussion of it a few days later.

Someone actually has a whole forum dedicated to finding things you can do with google here.

Apparently this was even a DEFCON speech subject.

http://johnny.ihackstuff.com/

Is googledorks a real hacker movement or just some random key word any one with a high ranking web page can abuse?

It appears to be a buzzword that Johnny Long just kinda made up. I used Google to "hack" away and find his website: http://johnny.ihackstuff.com/
It appears his definition of googledorking (?) is not just finding private info, but just anything wacky/weird/different, private is just one of those things.

Do we now call it g00g|3?

googleDork (gOO gol'Dork) noun 1. Slang. An inept or foolish person as revealed by Google.

googleDorks

googleDorks