Slashdot Mirror
Googling Your Way Into Hacking
knifee writes "New scientist is running an article explaining how hackers can use Google's cache to quickly hunt down sensitive pages, for example, by searching the terms "bash history", "temporary" and "password".
Might be worth looking at this tutorial about robots.txt if you think you might be at risk." That's pretty amusing.
For example, one common filename for passwords is "bash history".
/dev/null, just out of habit. The security problem isn't google's fault, it is stupid admin's who don't know what they are doing.
This guy is a security consultant? Come on, what admin in their right mind would enter a password in cleartext on the command line and allow it to be stored in ~/.bash_history? The first thing I do when I log onto a box is link bash_history to
Visualize the world of wine
google
Google can be used to illegaly hack into computers (possibly stealing copyrighted information). Google must be shut down and all of its users owe us lots of money.
if(!cool) exit(-1);
A quick search for "Password" doesn't yield any "promising" hacking results. It's too common a word.
Colossians 2:8
Damn script kiddies.
This is particularly useful for this type of thing since it isn't always obvious what the criteria are for what you want to search for - with WhittleBit you don't need to know, it figures it out for itself.
of course i have section on my site for bash scripts... and it has an index page. looks like someone got dissappointed.
2 1337 4 u!
They should mention that disallowing a URI in robots.txt tells crackers which URIs on your site have sensitive information. What I do is create a top-level /unpub/ URI, and everything sensitive goes underneath it with hard-to-guess names. In robots.txt I disallow /unpub only.
You're kidding right? Putting stuff in robots.txt is the best way to *guarantee* that robots will go specifically for the file/directories you choose to deny.
Don't be naive about robots.txt... expect to have to do some relatively fancy hacking to actually enforce it.
(Please browse at -1 to read this comment.)
use Google's cache to quickly hunt down sesitive pages,
Try hacking a dictionary.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Robots.txt only makes well-behaved search engines not index certain portions of your site. You're still going to be vulnerable until you take the sensitive pages off-line completely. But even then, if a passwords list has been indexed by Google, updating your robots.txt file won't remove it from Google's cache until Google spiders your site again. At which time, Google will discover the passwords list doesn't exist and remove it from the cache.
At least that's how it should work. Is anyone aware of Google requesting robots.txt more often than they spider pages? And then proactively removing pages from their cache based on new robots.txt entries?
While the article deals with Google specifically, lots of non-well-behaved spiders go through common locations looking for password files regardless of what you've blocked out with robots.txt. The only way to completely protect your data is to remove it from your site.
my blog
Having a robots.txt is a good idea but it always amuses me when web sites use robots.txt to list all the areas of their site that they don't what people to look at. When robots.txt contains entries like "Disallow: /admin.asp" or "Disallow: /backdoor.asp" it stops being a way of controlling search engines and becomes a site map of all the places hackers might be interested in.
It is always a good iea to kep the robots out of anywhere there is sensitive information. i several methods for added security. robot.txt is a good way, but i also the deflecction technique in apache's mod_rewrite to keep the crawlers out.
Consensus is good, but informed dictatorship is better
A friend of mine actually used this to steal ICQ numbers. He wrote a perl script wich googles from "00000001.idx 00000001.dat" to "99999999.idx 99999999.dat" and spits out the result links to a textfile if it gets a full match.
;)
The ICQ password is stored in one of those two datafiles and there are dozend of free decrypt programms for that out there.
But if you think about it... how or why does someone put his ICQ directory on a webserver?!
On the other hand... some people are hosting pr0n sites and dont even know about it
--
One by one the penguins steal my sanity...
So if I forgot my password, google can just tell me what it is? Can it tell me my credit card number too?
- mpg
- mov
- mp3
- secret - doesn't have to be file extensions...
- "My Documents" - yeah, that's secure...
- etc
Anyway, as you can see, it's pretty effective. Sometimes admins wise up, and all you have is the Google cache. But sometimes they don't, and you get to look. Thanks Google!A programmer is a machine for converting coffee into code.
If something is meant to be private, then why even temporarily put links to it on your publicly visible pages? Additionally, if something really is private, then lock it down in the httpd.conf so that only certain IP addresses can access it. Then, its basically invisible to the rest of the world.
Of course, if there's a bug in your server software all bets are off. Which is why it's better not to put private stuff where it can be seen on a public network.
I would have thought that was pretty obvious.
Just be sure to wear the gold uniform when you beam down -- you know what happens when you wear the red one.
You should really use something other than '*' for your password. It is far to easy to guess. Just a suggestion
-- Fighting mediocrity one bad post at a time.
I don't think so.
I went through all 6 pages of results and found nothing. Ditto for searches on any of the terms individually. I imagine that searches on individual sites might be what the author is actually talking about, but have no independant means of verifying this. This FUD detected by Entropy248. Wow. I just RTFA and tried it at home...
Webmaster Wanted - Entropic Reactions
This article gives me great ideas for a website:
/dev/tty blog - Everything I typed today /dev/stdout blog - Everything I saw today
* bash.history blog - Everything I ran today
*
*
COMING SOON: Welcome to My Bank Account Details, Favourite Passwords I Enjoy Using
> allows for an admin to see if anyone has compromised security, no?
Only if the compromisors are morons, and have done it "recently".
A non moron would type "HISTFILE=" before exiting a shell he'd been "playing" in.
Do daemons dream of electric sleep()?
Shouldn't that be bash_history, passwd and tmp?
Was this written down by a non-techie from an audio interview?
Regards,
--
*Art
It might be worth it NOT to look at robots.txt -- after all, with robots.txt you effectively disclose to anyone who asks what you don't want to be shown.
/secret/passwd
A robots.txt like this would be invaluable to a hacker, even though it would prevent Google from indexing:
User-agent: *
Disallow:
Regards,
--
*Art
It's supposed to be used to tell bots not to access some parts of your site due to other reasons.
Common reasons would be that you host a site with a forum on a DSL line and don't want google to index all 5000 threads on it. It's also good for dynamic pages, for example it makes no sense to index a generated page that will be out of date tomorrow. It'll be much better to let it index the archive instead.
Using this for security is just stupid though, as it'd contain a list of vulnerable places. Maybe it will make harder for people to find your vulnerabilities from google, but it will help a lot whoever wants to attack you specifically.
Security problems have to be fixed by setting proper permissions and keeping your server up to date, and not by relying on that every spider that comes to your site will be polite enough to follow robots.txt
The result looks like this:
I have seen more phpmyadmin pages wide open on google that anything else.. Not putting things like that under htaccess at least is pure laziness and stupidity.
Also it seems people put mysql dumps on their webservers as well..
search for ' "SELECT * FROM credit" + "###" ' and you will see.
This has been going on since google introduced the site cache.
anime+manga together at last.. in real time.
Long says an obvious combination of search terms would include the terms "bash history", "temporary" and "password".
Hmph. When I searched for those phrases at Google, all I got were a bunch of Linux technical how-tos and code samples. If this guy wants to teach us how to be hackers using Google, he's going to have to be more helpful than that!
BZZT, wrong.
/., you'll get neither.
* is a character not allowed in the encrypted 13-character A-Za-z0-9./ password, and as such the account can not be logged in to.
x is used for shadow passwords.
Anyhow, I think the original poster aimed for a +1 Funny, and not +1 Insightful. If there's any justice on
Regards,
--
*Art
Better to search for the first 8 digits of a known credit card number. Last time slashdot hahd a story about a site which was publishing credit card numbers on the internet, I googled for the first 8 digits of my CCN and found the site.
At least 5 years ago it was fairly common knowledge that if you found any webserver's access_log you would get some juicy URL's. The method still works...
Anyone familiar with Big Brother knows that it has web access pages that allow you to monitor servers on your network. Of course your suppose to keep these pages private, but lots of people dont. This makes it easy for us to determine what servers are running on a network, and what services are running on each server.
;)
Try searching google for: red Big Brother Status
Enjoy
try searching for _vti_pvt and service.pwd on Google. There are lots of people still using frontpage 4.0 or whatever, with their frontpage password file in plain view. I won't tell you what to do with that file, if you don't know already.
I regarding the ability to use Google as a warez search machine. The article was about Google censorship and the one response to my post pinpointed almost exactly the point that I brought up, which is the point discussed in this article.
Google has a nice long list of directory lists containing warez (remember the days of l33t FTP searching for filenames? Google for something like, in my last article: "xwin32*.exe * * * * *" "listing of"), serial numbers (Oh, I've found XP's serial number several times in Google's cache) and other "sensitive" information. My question is if other commercial sites are being constantly shut down due to these links (intentional or not), why aren't people targeting Google as well?
In fact, if I'm *cough*too cheap to buy software*cough* or just want to evaluate some crippleware or such before I buy it, I often skip astalavista and cracks.am and just Google it up. Saves me the porn and pop ups, and I don't have to cripple my browser for this (yes I know it's possible to do in other ways, yes I enjoy javascript, no thanks, I don't want comments about how I'm retarded because I don't do it the right way).
This is similar for sites such as the Internet Archive's Wayback Machine that contains other sensitive information.
Because of the academic merit of both of these search mechanisms, I doubt either one will be shut down. Indeed, I highly doubt restrictions will be placed. They're valuable tools for finding more valuable tools. For more information about this sort of stuff, I suggest searching on Fravia+'s web-searching lore. Other information on there relates to "reality cracking", reverse engineering, and other taboo topics. Google's got it all cached. Interested? Just search for (insert topic here) site:searchlores.org.
Sometimes I don't think the comparison of Google to God is that far off. Pardon my heresy.
Kind regards, Devon H. O'Dell
I honestly know of nobody else who uses this technique, I just figured I would try it back when I was hunting down upgrades for old games like Quake 2 while places like FilePlanet were getting hammered:
At google, type "index of", followed by the precise name of the file you are looking for.
I'd say this gives me good results on a fast server 95% of the time.
If you like this kind of tricks you can find dozen tricks like those ones and betteron Fravia's web site SearchLores.
-- search the web
if only slashdots search was as good as googles i could point out this is the third time in a year this "story" has been run.
MARIJUANA, SHROOMS, X: ONLINE?! - E
I guess I don't have the patience to be a real hacker.
Computers are useless. They can only give you answers.
-- Pablo Picasso
Google uses operating systems! All your code are belong to us! Google must be shut down and all of its users owe us lots of money.
Not the same kind of "hacks", but more than one might have missed that O'Reilly published recently Google Hacks. Mostly targeted to webmasters or "power users".
This paid my last vacation, it mi
You can probably use this to set up "honeypots" which may be legal in States where traditional fake services would be considered illegal as entrapment.
Simply set up a virtual machine (user-mode linux is a good one for this). Have the root account publicly read/write and somehow "accidently" visible to httpd.
Have the login shell a program which acts as your honeypot, logging activity, tracing back to the user, etc. All the stuff honeypots do so well.
Next is to ensure that the root password is visible, plain-text, and in a file that is visible to search engines. Your average skript kiddie is not going to question the apparent generosity of the admin. To get the engine to find the account, you probably want to have your main web page link into your virtual machine's root account - say via an FTP.
Now, none of this is entrapment, in the sense that the person must pro-actively attempt to present a false identity before the service is accessed. There can be no question that the identity of any user logging in is fake, that the user logging in knows that it is fake, and that there has been a deliberate, pre-meditated attempt to compromise an account.
If you want to go one step further, have the login shell transfer some goodies, such as cpuburn. Now, these have to have a "legit" use by a "legit" user, as anyone who gets burned is likely to complain. You have to be able to stand your ground and say "hey, I use this service as a convenient way to do hardware tests on remote machines - I locked that account against intruders, so if an intruder gets in, it's not my fault if they get burned."
(If you leave something dangerous "just lying around", you could probably be held accountable if someone gets hurt, even if they were stupid or malicious. But if you make a "reasonable" attempt to deny access, then it's not your problem.)
In fact, if you do any freelance tech stuff, you might very well use the service for real as a way of fetching over stress-testing software. It would make it a lot harder for "victims" of your root snare to complain, as you could then prove a legitamate use by legitamate users - the victim not being one of them.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
If you want to control the distribution of your work, don't publish it for free in a public place. That is your choice.
Your reference to usenet is laughable but common. Who should determine how long your posts should stay on a news server? Why does it have to stay on a news server? What if I save all messages I read for ever? What if one news server has a 3 year retention but another only has 3 hours? If you don't want your comments to become publicly availalble then don't post them publically. It is really that easy. You don't have to use x-no-archive, but you don't have to post either.
Bad boys rape our young girls but Violet gives willingly.
Here is a nice tutorial about the topic.
We do not have a history of profitable operations. Our future SCOsource licensing revenue is uncertain.
http://www.smart-dev.com/texts/google.txt
Sure, John. I just checked. Your Visa number is 4803 1809 2273 4821, expiration 03/05.
Your Discover card bill is overdue, though. Don't forget, according to this record, you've got 18.5% on overdue, PLUS your $15/mo late fee.
Your 'condition' should have been cleared up by now, so why'd you refill that prescription on Tuesday? Oh, wait, I see here that you deposited three brand new $20's at the US Bank down near Santa Fe. Doing a little insurance fraud, there? :)
Oh, I just googled again...your dog wants back in.
Any sufficiently well-organized Government is indistinguishable from bullshit.
This situation is a consequence of living an open society that information which "should not" be available is available.
This has nothing to do with google and cracking.
Exactly the same situation was demonstrated in the '70's by Princeton student "John Artistole Phillips", better known as "The A-Bomb Kid". For him, it was the telephone, university and public libraries, and fission weapons instead of google and cracking.
Again, news it ain't.
"Reality is that which, when you stop believing in it, it doesn't go away." - Philip K. Dick
Nope...doesn't pass the LUHN check. See LUHN Check.
"Rub her feet." -- L.L.
Probably not, but his statement of the situation squares with my experience when I talked to an FBI agent after having discovered (and logged) some IRC kiddies who were constructing a DDOS network out of sub7-infected machines.
I'd created a sub7 honeypot on my linux box with a little perl script; after that collected the IRC server ip and channel name, I connected with a random username (pretending to be a bot) and just logged the conversation.
The FBI agent interviewed me very carefully to make certain that my setting up monitoring, etc., was not in any way instigated by a law enforcement officer. (No, I'd just gotten annoyed at random SYN packets) Then, he had no trouble with it. I don't know if this makes the evidence I provided useable legally, but it never came to that. As he explained it, the question was whether I was acting as an agent of the state when setting up the honeypot. Committing entrapment is not anything that non-state actors ever need worry about.
Not that this lets you off the hook entirely - there may be charges of wiretapping involved; monitoring your own machine should be safe legal ground, but connecting to the IRC network (as I did) is a slight bit more dicey legally, and shouldn't be done if you have any reason to believe that the relevant prosecutor would like to hang something on you as well.
Also, entrapment is only illegal if the law officers used fraud or undue persuasion to cause someone to commit a crime -- so much so, that an ordinarily law-abiding person would be compelled to commit the crime.
n ts/nationalbudgetsdefecitsorspending/lawdeceit.htm l
Cops can tempt criminals to commit crimes, and even initiate or plan out the criminal act (ie, buying or selling drugs, offering or buying prostitution, planning a bank robbery heist). None of this is entrapment, unless their actions would have cause a normally law-abiding person to commit the crime.
If a cop tricks someone into unintenionally breaking the law, or harasses them so much that they eventually cave in and break the law, or threaten them, etc, it may be entrapment. It's actually pretty subjective and up to the jury, usually.
But a lot of misconceptions of entrapment abount -- ie the ever-popular, "if you ask them if they're a cop, and they say no, then it's entrapment." And also the misconception that entrapment is a crime and can apply to non-law-enforcement. It's not a crime, it's a defense against being charged with a crime. (Well, unless you perform a crime while trying to get someone to perform a crime -- that's still a crime)
For a somewhat inflammatory discussion, see this: http://www.libertyhaven.com/politicsandcurrenteve
I had a more objective look at it, written by a lawyer, but I can't find it.
sorry if this is off-topic.
The following sentence is true. The preceding sentence was false.
Hehe, no he didnt disapeared at all. And i can tell you he's alive and kicking. Yet you may find his old data here on the AntiCrack website.
One question: does WoW stands for Warriors of Wasteland?
-- search the web
Fucking navy.
Give me Classic Slashdot or give me death!
http://www.theregister.co.uk/content/55/32103.html
In short, the anti-spammers found a WSFTP.LOG and used it to find zips with email addresses.
Funny to see this on the register so soon after this slashdot article