Slashdot Mirror
Google Hacking for Penetration Testers
Google Hacking for Penetration Testers (Google Hacking for short) is Johnny Long and company's tome on the subject of using what is widely considered to be the web's only worthwhile search engine and the myriad of ways that you can get very specific information out of it. Not just for web pages, you can find Excel spreadsheets, Word documents, and all sorts of information that the owners thought was hidden. This is what makes Google hacking, as an activity, so interesting.
The Google Hacking book starts with Google search basics, which is usually way more than most people do in a given week of using Google. With nary a pause, Chapter 2 covers advanced Google search operators, such as exclusions, file types, and restrictions like "inurl:" and "phonebook:". By this point, you should be sufficiently armed to do some serious Google hacking. Together with the skills and the imagination to phrase what it is you're looking for, you can mine the web.
Chapter 3 provides a simple, fast-paced introduction to using Google to do more than find porn and stalk potential mates. You can dig around in sites to find, for example, backup scripts (which may expose database parameters, useful for SQL injections later on) and eve use Google to hide your tracks as a proxy server (note this only partially works).
The next few chapters focus on the Penetration Testers portion of the title. Chapter 4 starts with the preassessment of the target (of your pen-test), including digging around for information left by employees (ie mails that reveal employee lists), information about the company leaked in job postings (which may include technologies used), and all the kind of stuff you want to know before you start knocking around. Chapter 5 shows you how to use Google and a few other sites to map the target. After all, Google's indexed their site, why not use the data they gathered. Chapter 6 has some real meat in it, including how to find vulnerable CGI programs via Google queries (ie looking for formmail.cgi scripts).
Chapter 7, which is described as "Ten Simple Security Searches That Work", is surprisingly succinct and effective. It basically helps you map the restrictions you learned earlier into queries and data to help you penetrate a target's security without ever leaving Google. Chapters 8 and 9 help you understand how to use Google to enumerate what you can about resources and authentication credentials, and Chapter 10 describes how to pull up documents for your perusal, some of which may be real gems.
Chapter 11 is another interesting chapter, where you learn how to use these same techniques on your own site to determine what kinds of exposures you have. This can include private communications, confidential memos, and even internal configuration information. What doesn't get stressed too clearly at all is that some sites don't respect "robots.txt", for example, and will archive pages indefinitely even if they weren't supposed to. As such, even if you are protected from Google you may not be entirely protected. Now is a good time to learn how to use other major search engines.
I liked where Chapter 12 is headed with automated Google searches via the API and page scraping, but I think more could have been done here to show better, more useful code. As it stands, you'll have to expend some more elbow grease to translate a lot of what you learned earlier into a useful tool for yourself (if you want to write your own). The two appendices on "Professional Security Testing" and "An Introduction to Web Application Security" seem out of place, though, and could have been bridged into the whole book much more cleanly.
Overall I'm not as thrilled with this book as I would have liked to have been for a few key reasons. First, I found the presentation of the book, specifically organization, language and screenshot displays, to be only average. The organization of the book itself seems to jump around sometimes, going from recon work to attacks and then back to basic outside recon work. This becomes a burden when you want to refer back to the book to find a useful portion or to understand the progression of an idea.
Secondly, I found the writing to be heavy with all kinds of 'Leet Hacker' types of references, which get old pretty quickly and only drown out useful information. At over 500 pages, you'd think this book was truly bursting at the seams with information, but a lot of it is redundant or hidden under excess fluff.
Finally, a number of the screenshots are full screens when they could have been only pieces of a screen or a window to achieve an improved effect. This matters because the halftone printing process leaves the images blurry, and a large window or screen is blurry at the book's printing resolution. This is something I've found in common between a bunch of Syngress books, and I hope they'll address it shortly by reviewing their screenshot design.
In conclusion, there's nothing too significantly special about Google hacking. With a bit of elbow grease, some example code for the Google API, reading Google's own docs, and some experimentation you can find yourself at the same level you'd be at with the book, and about $40 heavier, too. However, Long and co-authors have assembled a good number of Google methods together, and if you're the kind of person who prefers to get right to productive work with a book, it's probably the best book I've seen on using Google for more than simple searches.
You can purchase Google Hacking from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
A review of a book about hacking, without a lengthy diatribe about the misuse of the word "hacking" to precede it. It's as if the reviewer realizes that his target audience has already attained a certain level of proficiency in the technological lexicon.
This is no secret- One of the best sources for salespeople to prospect is google. If you type in a company name and title, a lot of times you will find out the name- but not from the company site, from an alumni newsletter or the like. A lot of times you can find password protected lists of professional society rosters too....
I think the moral here is, if you don't want people looking at it, don't hang it out unprotected.... Unprotected penetration can lead to unexpected dialation... Oh wait, thats health class
And All I Ask is a Tall Ship And a Star to Steer Her By
for law enforcement.
John Scmidt
johnschmidt.dk
Because, honestly, nobody knows how ubiquitous Google is except for Google. Your number is complete and total rubbish.
The book, Google Hacking, exists because there's a such thing as "Google Hacking", and google is an accepted English word meaning "to search". If you want to think about it, Google Hacking means exactly the same thing as Search Hacking, which really isn't that different from Search Engine Hacking, especially if you're talking about the internet.
Semantics aside, Google is a dataheap waiting to be mined. Just about anything you want to know about human patterns dealing with the Internet can be figured out through Google in some way or another, and a lot of patterns that are offline can be assessed as well (Maps? Local? News?).
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
When you consider the kind of information this independent group has shown can be found using Google, consider what the engineers at Google who designed the various search systems and web-bots can garner from it, for all we know, the data that can be gleaned from this book may only be a glimpse of the restricted information Google could potentially gather, kept from the web-surfing masses.
We hear about blackmail cases involving compromised data occuring all the time, and coupled with corperate espionage, a group like google could stand to see far greater profits then mere 'advertising'
for those preparing to mod me down, consider this:
Knowledge is Power, and as far as everyone is Conserned, Google is probably at this moment, the source of more human knowlege then has ever been compiled before, all cached on their wonderful servers, and through their extensive knowledge of where any data they may need to see in the future resides.
Absolute Power corrupts absolutely: in a case where such secret information is availiable, no person or group is every above the incentive to gain from this power, including Google, or if not that, inticed individual employees
people really need to start analizing the Power Google has over information and take its immense position seriously. at least books like this can only open more light on this growing problem