Slashdot Mirror
Googling Your Way Into Hacking
knifee writes "New scientist is running an article explaining how hackers can use Google's cache to quickly hunt down sensitive pages, for example, by searching the terms "bash history", "temporary" and "password".
Might be worth looking at this tutorial about robots.txt if you think you might be at risk." That's pretty amusing.
google
Google can be used to illegaly hack into computers (possibly stealing copyrighted information). Google must be shut down and all of its users owe us lots of money.
if(!cool) exit(-1);
Damn script kiddies.
use Google's cache to quickly hunt down sesitive pages,
Try hacking a dictionary.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Wouldn't it be more fun to ln -s ~/.bash_history /dev/random instead?
;)
Would make for interesting google logs.
Don't have to worry about that particular problem. Both FreeBSD and MacOS X use tcsh by default anyway, and all of my users are Unix stupid, so they never log into shell.
Karma: Chameleon (mostly due to the fact that you come and go).
Yeah, like I always store my bash history in below my DocumentRoot directory.
Anybody that does this is Running with Scissors.
"Provided by the management for your protection."
So if I forgot my password, google can just tell me what it is? Can it tell me my credit card number too?
You should really use something other than '*' for your password. It is far to easy to guess. Just a suggestion
-- Fighting mediocrity one bad post at a time.
This article gives me great ideas for a website:
/dev/tty blog - Everything I typed today /dev/stdout blog - Everything I saw today
* bash.history blog - Everything I ran today
*
*
COMING SOON: Welcome to My Bank Account Details, Favourite Passwords I Enjoy Using
Even better yet, "rm ~/.bash_history && ln -s /dev/dsp ~/.bash_history". Now everything you type will literally "sound like crap".
We have a situation here, folks. Something must be done!
Well, what do you expect from "new scientist"?
"Reality is that which, when you stop believing in it, it doesn't go away." - Philip K. Dick
Doncha just love the fact that the first my documents returned is an MIT students lab PC describing security over wireless networks? haha
Long says an obvious combination of search terms would include the terms "bash history", "temporary" and "password".
Hmph. When I searched for those phrases at Google, all I got were a bunch of Linux technical how-tos and code samples. If this guy wants to teach us how to be hackers using Google, he's going to have to be more helpful than that!
Except that it doesn't work, unless you intended to try to execute /dev/audio.
OHMYGOD!! TEH SECURITY RAMIFICATIONS!!1!c e/.bash_history
i test1 ../business/
http://custom.lab.unb.br/pub/d
pwd
ls -l
ls -l
ls -la
whoami
http://www.mhhe.com/socscience/.bash_history
v
ls -l
who am i
touch test2
ls -l
pwd
cd
ls -l
vi randomfile
ls
ls -l
cd marketing
ls -l
pwd
search "index of mp3" ;)
More than once, when looking for a specific dll, I've found a whole software install in a directory on somebodys network.
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
ROFL -- It's also amusing when the admins don't understand what the file is for!
:-P
Look at IBM:
http://www.ibm.com/robots.txt
First comment:
Date: 19950130
By: epc
Reason: finally understood what the file was for!
At least the admin was honest, but a bit embarrasing for being on ibm.com.
Beware: In C++, your friends can see your privates!
I guess I don't have the patience to be a real hacker.
Computers are useless. They can only give you answers.
-- Pablo Picasso
Google uses operating systems! All your code are belong to us! Google must be shut down and all of its users owe us lots of money.
Well, we had a stupid admin who, as a test put the /etc/passwd file into webspace.
We had another admin who tried to su to root and typed in su [root password]. We check the logs searching for someone typing in a non-user account that looks like garbage and we notify the admin to change their password.
Shit better not happen!
Oooh that's cool! check this link out that it turned up:
http://www.liada.net/~secret/
all in spanish, but the documents are all about toxic substances, i think... and there's one JPEG that appears to be a sketch of a missle! Now that's top secret!
In all matters of opinion, our adversaries are insane. -Oscar Wilde
Sure, John. I just checked. Your Visa number is 4803 1809 2273 4821, expiration 03/05.
Your Discover card bill is overdue, though. Don't forget, according to this record, you've got 18.5% on overdue, PLUS your $15/mo late fee.
Your 'condition' should have been cleared up by now, so why'd you refill that prescription on Tuesday? Oh, wait, I see here that you deposited three brand new $20's at the US Bank down near Santa Fe. Doing a little insurance fraud, there? :)
Oh, I just googled again...your dog wants back in.
Any sufficiently well-organized Government is indistinguishable from bullshit.
Even more entertaining is to add a disallow: /secret.cgi entry, and then have secret.cgi log the IP address, datetime, etc, of requests.
For bonus points, you can have secret.cgi automatically add requesting IP's to an apache rewrite config file.
Cheers
-b