1 00:00:03,040 --> 00:00:04,240 All right. 2 00:00:04,420 --> 00:00:05,220 Thanks for coming. 3 00:00:05,220 --> 00:00:08,680 My name is Johnny Long, in case you're in the wrong spot. 4 00:00:10,580 --> 00:00:13,700 Presentation today is called Google Hacking for Penetration Testers. 5 00:00:13,700 --> 00:00:15,360 How many of you have seen me speak before? 6 00:00:15,620 --> 00:00:16,400 Show of hands. 7 00:00:16,400 --> 00:00:16,840 Okay. 8 00:00:16,840 --> 00:00:19,720 How many of you have seen me speak on the topic of Google? 9 00:00:20,440 --> 00:00:21,140 Okay, cool. 10 00:00:21,140 --> 00:00:23,740 Thanks for coming and seeing me speak about Google again. 11 00:00:25,460 --> 00:00:26,640 Next year it'll be different. 12 00:00:26,640 --> 00:00:27,520 It'll be Yahoo. 13 00:00:30,420 --> 00:00:36,940 I have about an hour and a half talk here, which I'm told is just not possible. 14 00:00:37,240 --> 00:00:39,800 So I'm going to be flying through some stuff early on. 15 00:00:39,800 --> 00:00:41,760 The format of the talk is pretty straightforward. 16 00:00:41,800 --> 00:00:45,000 I go through some technical mumbo-jumbo in the beginning. 17 00:00:45,340 --> 00:00:49,680 It's a little bit dry, so for those of you that aren't technical, feel free to nap then. 18 00:00:50,200 --> 00:00:54,400 Because things get interesting towards the end and we have a nice firework show at the end. 19 00:00:54,400 --> 00:00:57,580 So those of you that nap, do it now. 20 00:00:58,400 --> 00:01:10,540 Also, after the talk, in the next room, just on the other side of this wall, we're going to do a book signing for the book by the same name written by some guy named Johnny that has gotten decent reviews and has lots of pretty pictures. 21 00:01:11,180 --> 00:01:13,120 So you might want to check that out. 22 00:01:13,120 --> 00:01:14,780 So I'll be doing a book sign across the wall. 23 00:01:15,380 --> 00:01:17,100 Also, we're going to be doing a contest. 24 00:01:17,320 --> 00:01:19,600 This worked out fairly well for Black Hat. 25 00:01:20,220 --> 00:01:21,740 I expect it to work out. 26 00:01:21,740 --> 00:01:22,860 Oh, cell phone rules. 27 00:01:22,860 --> 00:01:26,300 For every ring of a cell phone, it's $5 to a charity of my choice. 28 00:01:26,840 --> 00:01:28,100 That usually works. 29 00:01:28,480 --> 00:01:30,680 We're going to be doing a live Google hacking contest. 30 00:01:30,680 --> 00:01:40,560 For those of you that know a little bit about this topic and have come armed to actually win some prizes in the form of books from Syngress, I have two folks in the back that are helping me out. 31 00:01:41,560 --> 00:01:44,300 Hey Josh, Josh and Nick, can you put your hands up? 32 00:01:44,300 --> 00:01:46,500 Back here, against the wall. 33 00:01:46,500 --> 00:01:50,740 If you guys are interested in entering the Google hacking contest, here's what we're looking for. 34 00:01:50,740 --> 00:02:02,000 Interesting queries that are not already public, that cough up sensitive information, sort of a gentleman's agreement that they actually work and that they're actually unique. 35 00:02:02,100 --> 00:02:02,960 But here's the deal. 36 00:02:02,960 --> 00:02:08,760 To claim your prize, you need to come up in front of all these people and in front of that camera to claim your prize. 37 00:02:09,320 --> 00:02:15,060 We will have your email address and we'll inform all the other contestants of your cheating, lying ways. 38 00:02:16,220 --> 00:02:19,240 And we will give them your email address, so be warned. 39 00:02:19,500 --> 00:02:27,040 But anyway, seriously, if you guys have some interesting queries that you'd like to send to the guys in the back, we've got lots of prizes that we'd be happy to hook you up with. 40 00:02:27,380 --> 00:02:29,420 Alright, so let's dig in. 41 00:02:30,640 --> 00:02:32,760 This is the part that I'm going to go short on. 42 00:02:32,760 --> 00:02:34,200 How many of you have used Google? 43 00:02:34,480 --> 00:02:35,440 Show of hands. 44 00:02:38,400 --> 00:02:40,580 Everybody else has to leave, that's it. 45 00:02:41,500 --> 00:02:44,700 Alright, how many of you have used Google with advanced operators? 46 00:02:44,820 --> 00:02:45,580 Show of hands. 47 00:02:45,580 --> 00:02:46,460 Good, excellent. 48 00:02:46,460 --> 00:02:48,580 So I will go pretty light with this. 49 00:02:48,580 --> 00:02:50,660 Advanced operators are pretty straightforward. 50 00:02:50,720 --> 00:02:54,500 You basically put them right in with your query, just like your other search terms. 51 00:02:54,640 --> 00:02:58,440 The syntax is an operator followed by a colon followed by a thing. 52 00:02:58,440 --> 00:03:00,320 I'll call it a search term. 53 00:03:00,320 --> 00:03:02,400 There's no space before or after the colon. 54 00:03:02,400 --> 00:03:05,460 So let's get an idea of what some of the operators are. 55 00:03:05,480 --> 00:03:08,640 This is ripped right from a Singris book. 56 00:03:08,820 --> 00:03:11,360 It's the first time I ever enjoyed copyright infringement. 57 00:03:11,360 --> 00:03:12,340 It felt great. 58 00:03:13,960 --> 00:03:25,420 Anyway, you've got all the operators down the left-hand side, what the operator is, followed by the purpose of the operator, followed by a couple things that identify where the operator can be used and whether or not it plays nicely with the other operators. 59 00:03:25,820 --> 00:03:30,760 One of the things you'll realize when you start messing with this stuff is that some operators are just plain nasty. 60 00:03:30,800 --> 00:03:32,960 They just don't like to be messed around with. 61 00:03:32,980 --> 00:03:35,500 So this table sort of helps sort things out. 62 00:03:35,880 --> 00:03:39,520 But here's how... I'm going to skip this one because this is a bad demonstration. 63 00:03:40,500 --> 00:03:43,660 Here's how advanced operators can work. 64 00:03:43,880 --> 00:03:45,860 And by the way, I have 209 slides. 65 00:03:45,860 --> 00:03:47,640 Does anybody have more than that at DEF CON? 66 00:03:49,080 --> 00:03:49,720 Sweet. 67 00:03:49,780 --> 00:03:51,460 I have PowerPoint foo. 68 00:03:53,080 --> 00:03:54,660 Alright, we will get through them all. 69 00:03:54,920 --> 00:03:57,420 Alright, let's use advanced operators to actually find this page. 70 00:03:57,420 --> 00:03:59,120 This is a page from my website. 71 00:03:59,360 --> 00:04:03,320 And what I'm going to do is I'm actually going to define this page with advanced operators. 72 00:04:05,960 --> 00:04:07,240 That's true. 73 00:04:07,700 --> 00:04:11,000 My PowerPoint foo skills are gone now. 74 00:04:13,480 --> 00:04:16,740 You will be able to get this off my website after the conference. 75 00:04:16,740 --> 00:04:24,360 I felt very uncomfortable pushing the 40 megs worth of Google joy up on my server with all of you evil people around. 76 00:04:24,980 --> 00:04:27,320 After the con, you guys can pick it up. 77 00:04:27,380 --> 00:04:28,720 I have yo-yo skills, though. 78 00:04:32,990 --> 00:04:35,090 So let's define this page. 79 00:04:35,090 --> 00:04:35,550 Here you go. 80 00:04:35,550 --> 00:04:36,850 In title, I hack stuff. 81 00:04:36,850 --> 00:04:37,790 Notice we're using a phrase . 82 00:04:37,790 --> 00:04:39,470 We're looking for a phrase in the title. 83 00:04:39,830 --> 00:04:42,450 I'm building a Google query here to define the page. 84 00:04:42,450 --> 00:04:43,670 File type, PHP. 85 00:04:43,670 --> 00:04:45,270 This is a PHP page. 86 00:04:47,410 --> 00:04:48,430 Num range. 87 00:04:48,690 --> 00:04:52,970 Num range got a lot of press last year through no fault of my own. 88 00:04:53,010 --> 00:05:00,110 And I still won't describe the evil uses of num range, but if you haven't figured it out by now, all hope is lost for you. 89 00:05:00,610 --> 00:05:02,810 But num range is absolutely evil. 90 00:05:03,270 --> 00:05:03,990 I know you. 91 00:05:05,770 --> 00:05:08,810 I think you're going to need to come up here and drink that if you're bringing it up. 92 00:05:09,070 --> 00:05:09,510 Yeah. 93 00:05:09,510 --> 00:05:10,250 Come on. 94 00:05:11,290 --> 00:05:12,970 Who wants Mudge to sit up here? 95 00:05:20,070 --> 00:05:20,710 Okay. 96 00:05:21,630 --> 00:05:22,970 What are you going to do with my DNA? 97 00:05:24,250 --> 00:05:25,610 I've already got it elsewhere. 98 00:05:30,860 --> 00:05:32,400 None of you heard that. 99 00:05:34,160 --> 00:05:34,820 All right. 100 00:05:34,820 --> 00:05:35,700 On with the show. 101 00:05:36,380 --> 00:05:38,080 Let's go a little bit farther in text. 102 00:05:38,180 --> 00:05:43,760 Navigate in text is a little bit goofy because in text sort of does what you think Google searching normally does. 103 00:05:43,760 --> 00:05:45,880 It finds stuff in the text of a web page. 104 00:05:45,900 --> 00:05:52,620 But the bottom line here is you throw all of this crap together into one big nasty query and you get something that looks like this. 105 00:05:52,620 --> 00:05:53,520 One result. 106 00:05:53,520 --> 00:05:58,320 You've basically used advanced operators to narrow down your search very efficiently. 107 00:05:58,920 --> 00:06:00,120 So there we go. 108 00:06:00,120 --> 00:06:00,660 One hit. 109 00:06:00,860 --> 00:06:03,440 That's advanced Google searching. 110 00:06:03,500 --> 00:06:06,920 I've gotten a lot of flack about the term Google hacking. 111 00:06:06,920 --> 00:06:08,460 So let's show where the line is. 112 00:06:08,840 --> 00:06:14,300 Google hacking basically is looking for pages that look something like this. 113 00:06:14,600 --> 00:06:17,020 Can anybody tell me what this URL might describe? 114 00:06:23,180 --> 00:06:24,080 Thank you. 115 00:06:24,080 --> 00:06:24,640 Thank you. 116 00:06:24,640 --> 00:06:25,840 Thanks so much. 117 00:06:26,900 --> 00:06:27,480 Okay. 118 00:06:27,480 --> 00:06:29,280 I'm here in e-commerce, right? 119 00:06:30,060 --> 00:06:31,060 Shopping cart. 120 00:06:31,060 --> 00:06:31,540 Yeah. 121 00:06:31,980 --> 00:06:33,240 I hear credit cards. 122 00:06:33,240 --> 00:06:34,140 There you go. 123 00:06:34,180 --> 00:06:34,400 Yeah. 124 00:06:34,400 --> 00:06:37,800 This is basically... well, we'll show you what it describes, but here's the query. 125 00:06:37,900 --> 00:06:41,860 In URL admin, in URL orders, file type PHP. 126 00:06:42,060 --> 00:06:42,920 It's a nice query. 127 00:06:42,920 --> 00:06:43,600 Throw it into Google. 128 00:06:43,600 --> 00:06:45,400 You find pages that look like this. 129 00:06:45,520 --> 00:06:47,160 It's the back end of an e-commerce site. 130 00:06:47,160 --> 00:06:49,780 It's the administrative page for an e-commerce site. 131 00:06:49,840 --> 00:06:51,080 So you've got customer orders. 132 00:06:51,080 --> 00:06:52,040 You've got order amounts. 133 00:06:52,040 --> 00:06:53,300 You've got ship dates. 134 00:06:53,540 --> 00:06:53,720 Okay. 135 00:06:53,720 --> 00:06:58,800 And then on the bottom right, you can see we've got payment details including bank information, credit card information. 136 00:06:59,120 --> 00:06:59,420 Okay. 137 00:06:59,420 --> 00:07:01,520 This is the heart and soul of Google hacking. 138 00:07:01,520 --> 00:07:09,520 It's basically using Google, first of all, to do things that it wasn't necessarily designed to do, and secondly, find things that aren't necessarily public. 139 00:07:09,820 --> 00:07:10,580 All right. 140 00:07:10,800 --> 00:07:20,760 Now, I came up with this interesting term called Google dork, which by my own definition is a foolish or inept person as revealed by Google. 141 00:07:20,920 --> 00:07:21,800 All right. 142 00:07:21,820 --> 00:07:28,180 So the term Google dork has gotten pretty popular despite the fact that Google has not put it on their web page anywhere. 143 00:07:28,900 --> 00:07:34,300 But it's become obvious lately that Google has started blocking queries. 144 00:07:34,640 --> 00:07:35,020 Okay. 145 00:07:35,020 --> 00:07:41,320 And I call the blocking of malicious queries the GDDS for the Google dork detection system. 146 00:07:44,000 --> 00:07:45,320 This is just a blurb. 147 00:07:45,320 --> 00:07:46,380 I'm going to fly past this. 148 00:07:46,380 --> 00:07:52,640 This is basically legalese so that the white hats in the community don't yell at me for, you know, revealing this thing. 149 00:07:52,640 --> 00:07:55,760 Bottom line is, Google's blocking queries. 150 00:07:55,760 --> 00:07:59,960 They've never before stepped into this game of messing with your queries. 151 00:07:59,960 --> 00:08:00,180 Okay. 152 00:08:00,180 --> 00:08:07,660 They've been in the ivory, I don't want to say ivory tower, it's got negative connotations, but they've never jumped into the security game before until now. 153 00:08:07,660 --> 00:08:12,020 Well, the problem that I have with that is that they're not doing it very well. 154 00:08:12,020 --> 00:08:13,380 Let's take a look at why. 155 00:08:13,540 --> 00:08:16,500 Anybody run into a page like this when they're doing a Google query? 156 00:08:16,620 --> 00:08:17,640 Show of hands. 157 00:08:18,000 --> 00:08:18,660 Anyone? 158 00:08:18,660 --> 00:08:20,020 You all are evil. 159 00:08:20,020 --> 00:08:21,240 Everyone look around. 160 00:08:21,540 --> 00:08:23,620 People with their hands up are evil. 161 00:08:24,080 --> 00:08:24,540 Okay? 162 00:08:26,440 --> 00:08:31,400 This screen comes up when you try a malicious query and Google just doesn't like it. 163 00:08:31,400 --> 00:08:34,740 So what we're going to do is we're going to actually try to bypass this screen. 164 00:08:34,820 --> 00:08:37,820 So this was for inurladmin.php. 165 00:08:37,860 --> 00:08:41,240 This is what the query looks like in the form of a URL up at the top. 166 00:08:41,240 --> 00:08:45,400 Down the middle, for those of you in the back that can't see, I've basically highlighted the query part. 167 00:08:45,400 --> 00:08:49,140 It says inurl colon admin dot php. 168 00:08:49,160 --> 00:08:54,440 Well, here's uber hacker trick oday of the talk number one. 169 00:08:54,480 --> 00:08:55,020 Okay? 170 00:08:55,440 --> 00:08:57,220 I've got lots of them. 171 00:08:57,540 --> 00:09:00,380 Unfortunately, this is like oday from like 84. 172 00:09:01,440 --> 00:09:02,160 All right. 173 00:09:02,160 --> 00:09:07,340 So our first bypass technique involves just changing the case of any of the words in the query. 174 00:09:07,460 --> 00:09:11,740 So how about admin dot capital php? 175 00:09:12,840 --> 00:09:16,280 So what do you think happens when we fire off any of these queries? 176 00:09:17,100 --> 00:09:19,240 Lo and behold, it goes through. 177 00:09:19,380 --> 00:09:20,060 Okay? 178 00:09:20,060 --> 00:09:29,700 Now, I'm not going to pick on Google too much for this one because about two days after I talked about this in Japan for Black Hat, magically this got fixed. 179 00:09:29,700 --> 00:09:31,480 Which was cool. 180 00:09:31,480 --> 00:09:32,880 I counted that as a personal victory. 181 00:09:32,880 --> 00:09:34,660 I was like, all right, well, let's keep going. 182 00:09:34,660 --> 00:09:35,820 So that was round one. 183 00:09:36,020 --> 00:09:37,880 Let's talk about round two. 184 00:09:38,940 --> 00:09:40,880 Round two is query shifting. 185 00:09:40,880 --> 00:09:43,060 Here's an interesting query. 186 00:09:43,120 --> 00:09:48,980 This one is for a index dot php file that has php bb2 somewhere in the URL. 187 00:09:48,980 --> 00:09:49,960 And they block it. 188 00:09:49,960 --> 00:09:51,020 Malicious query. 189 00:09:51,300 --> 00:09:53,380 So call this query shifting. 190 00:09:53,380 --> 00:09:59,940 Basically what I'm going to do is I'm going to use the same query for all intents and purposes, but I'm going to use different operators. 191 00:09:59,940 --> 00:10:07,100 So I'm going to look for php bb2 in the URL still, a file type of php and the word index. 192 00:10:07,320 --> 00:10:10,160 It's essentially the same query and it goes through. 193 00:10:10,160 --> 00:10:13,640 Shift around Google's operators, make the search a little bit different, it goes through. 194 00:10:13,640 --> 00:10:14,740 Query shifting. 195 00:10:15,780 --> 00:10:18,200 This one's my personal favorite. 196 00:10:18,420 --> 00:10:24,760 Some of these are getting fixed, like as we speak, some of them are still lingering, so your mileage may vary. 197 00:10:24,760 --> 00:10:28,480 But anyway, powered by php bb gets blocked. 198 00:10:29,280 --> 00:10:31,760 Now, this is a leap . 199 00:10:31,760 --> 00:10:33,480 Just wait for it. 200 00:10:33,480 --> 00:10:36,360 Check out what you do to get the query to go through. 201 00:10:42,660 --> 00:10:43,400 Okay . 202 00:10:43,400 --> 00:10:48,360 Putting spaces between the letters and the word powered lets the query go through. 203 00:10:48,360 --> 00:10:51,340 Now, you would think that this would just not work. 204 00:10:51,340 --> 00:10:53,960 Google would take one look at this and go, you're a frigging idiot. 205 00:10:55,180 --> 00:10:59,020 Well, they do it nicely and it would be in pleasing colors that weren't offensive. 206 00:10:59,040 --> 00:11:02,520 But, you know, normally they'd like fix it for you. 207 00:11:02,520 --> 00:11:05,140 Well, Google does actually fix this query for you. 208 00:11:05,140 --> 00:11:10,800 They take one look at it and they're like, what you meant to say was powered, but hold on, let me check the query to see if it's evil. 209 00:11:10,800 --> 00:11:11,640 Not evil. 210 00:11:11,640 --> 00:11:17,840 Okay, I'm going to fix it so that I'm searching for what you're looking for and I'm going to search for powered by php bb. 211 00:11:17,840 --> 00:11:24,680 You can tell it's searching for that because down in the actual query results, it highlights the words powered by php bb. 212 00:11:25,600 --> 00:11:27,580 I'm telling you, oday from 84. 213 00:11:28,720 --> 00:11:29,460 All right. 214 00:11:29,580 --> 00:11:34,920 Here's another example, same thing, powered by php bb2, blah, blah, blah, throw some spaces in there. 215 00:11:34,920 --> 00:11:38,040 It also works if you throw pluses between the letters in the URL. 216 00:11:38,100 --> 00:11:39,360 That's also elite. 217 00:11:40,880 --> 00:11:43,600 How many of you have seen this message? 218 00:11:44,080 --> 00:11:45,360 Show of hands. 219 00:11:45,700 --> 00:11:46,340 Okay. 220 00:11:46,340 --> 00:11:49,160 Those 10 people are really evil. 221 00:11:49,200 --> 00:11:49,720 All right. 222 00:11:49,720 --> 00:11:53,500 This is the message that you get when you violate Google's terms of service. 223 00:11:54,080 --> 00:11:55,740 That you've all read. 224 00:11:58,540 --> 00:11:59,740 You're laughing at me. 225 00:11:59,740 --> 00:12:00,940 I saw a lot of hands. 226 00:12:00,940 --> 00:12:03,720 I saw a lot of people in the audience say, yeah, you're Google users. 227 00:12:03,720 --> 00:12:07,400 So how many of you Google users have read the terms of service? 228 00:12:08,320 --> 00:12:09,600 That's what I thought. 229 00:12:10,580 --> 00:12:11,340 Yeah. 230 00:12:11,340 --> 00:12:11,740 All right. 231 00:12:11,740 --> 00:12:15,060 Well, Google's terms of service says don't do automation. 232 00:12:15,120 --> 00:12:16,380 That's the long and short of it. 233 00:12:16,380 --> 00:12:17,460 They give you some alternatives. 234 00:12:17,460 --> 00:12:19,020 The alternatives sort of suck. 235 00:12:19,080 --> 00:12:20,680 But they say don't do automation. 236 00:12:20,680 --> 00:12:24,360 I got this message by actually curling for a Google query. 237 00:12:24,480 --> 00:12:25,600 I used curl. 238 00:12:25,680 --> 00:12:26,660 There's my query. 239 00:12:26,660 --> 00:12:30,460 Fired it into poo.html, which doesn't mean anything, by the way. 240 00:12:30,820 --> 00:12:32,040 And I viewed the page. 241 00:12:32,040 --> 00:12:33,740 And we get this forbidden message. 242 00:12:33,820 --> 00:12:40,280 Now, can anybody tell me exactly what's different between curl and any other web browser that Google might be interested in? 243 00:12:40,700 --> 00:12:41,760 Thank you. 244 00:12:42,360 --> 00:12:42,980 Oday. 245 00:12:42,980 --> 00:12:43,800 Here we go. 246 00:12:43,800 --> 00:12:49,140 How about if you throw a user agent into curl and actually try it again, what do you think happens? 247 00:12:50,740 --> 00:12:51,540 Yeah. 248 00:12:51,660 --> 00:12:52,900 Throw a user agent in there. 249 00:12:52,900 --> 00:12:54,620 Now, I threw a really nice user agent in there. 250 00:12:54,620 --> 00:12:55,680 I did a little bit of research. 251 00:12:55,680 --> 00:12:56,640 Got out my sniffer. 252 00:12:56,640 --> 00:12:58,020 I was feeling all Uber. 253 00:12:58,080 --> 00:13:00,900 I'm like, ooh, look at the nice user agent for my browser. 254 00:13:00,960 --> 00:13:02,000 Copied into curl. 255 00:13:02,000 --> 00:13:03,280 I'm like, yeah, I'm the man. 256 00:13:03,460 --> 00:13:08,620 And then I started thinking, you know, I really can't type as well as I used to. 257 00:13:08,620 --> 00:13:10,100 And I actually looked at my curl command line. 258 00:13:10,100 --> 00:13:11,180 I had this typo in there. 259 00:13:11,180 --> 00:13:15,400 I actually had a F space Firefox as my web browser. 260 00:13:15,420 --> 00:13:21,560 And then I thought to myself, I wonder what happens if I just throw, you know, like poo in there as the user agent. 261 00:13:21,560 --> 00:13:22,440 What would happen? 262 00:13:22,640 --> 00:13:24,100 Take a guess what happens. 263 00:13:24,520 --> 00:13:25,460 It works. 264 00:13:25,460 --> 00:13:25,840 All right. 265 00:13:25,840 --> 00:13:29,960 So, Google's looking at the user agent, but they don't give a fly and flip exactly what you put in there. 266 00:13:29,960 --> 00:13:32,560 It just has to be in there somewhere, which makes sense. 267 00:13:32,560 --> 00:13:35,240 They don't want to block the newest browsers from getting search results. 268 00:13:35,240 --> 00:13:38,100 So, anyway, that's how you get past some automation. 269 00:13:38,840 --> 00:13:39,040 All right. 270 00:13:39,040 --> 00:13:40,300 Question is, why do this? 271 00:13:40,300 --> 00:13:42,940 Bottom line is, Google's not going to protect you from evil searches. 272 00:13:42,940 --> 00:13:45,240 You got to take the battle into your own hands. 273 00:13:46,560 --> 00:13:47,000 All right. 274 00:13:47,000 --> 00:13:47,960 Let's keep moving. 275 00:13:48,380 --> 00:13:51,760 I'm going to fly through this, because this is pretty basic stuff. 276 00:13:51,760 --> 00:13:54,980 And it was fluff for the people at Black Hat, because they're not as smart as you guys. 277 00:13:56,340 --> 00:13:57,320 Just kidding. 278 00:13:57,540 --> 00:13:58,240 All right. 279 00:13:58,240 --> 00:14:02,640 Bottom line is, there's some interesting things you can do if Google queries just don't work out for you. 280 00:14:02,640 --> 00:14:05,180 This is an example of a query looking for email addresses. 281 00:14:05,180 --> 00:14:08,040 We're some spam troll, and we're out there looking for email addresses. 282 00:14:08,040 --> 00:14:10,060 So, we look for at gmail.com. 283 00:14:10,060 --> 00:14:11,980 Well, Google throws away the at sign. 284 00:14:12,160 --> 00:14:12,360 Okay. 285 00:14:12,360 --> 00:14:25,100 The bottom line is, there's lots of data out there in Google that can be mined very effectively for all sorts of different things, and can be mined in such a way as to not send any packets to the target that you're trying to get more information about. 286 00:14:25,140 --> 00:14:26,820 We'll talk about anonymity in a minute. 287 00:14:26,820 --> 00:14:40,120 Bottom line is, if Google queries don't work for you, and yeah, this is really elite, too, you know, using a regular expression on an HTML file dump of a query page gets you the same result. 288 00:14:40,120 --> 00:14:48,320 For example, I use links to actually do the same query, pull the results down, and then I look in that file for gmail addresses using a regular expression. 289 00:14:48,340 --> 00:14:48,740 Okay. 290 00:14:48,740 --> 00:14:49,860 Pretty straightforward. 291 00:14:50,120 --> 00:15:00,000 But the bottom line is, this is a little bit, you know, it's a little bit hard doing it this way, you know, with links, but if you search more and more pages, you can actually get more results. 292 00:15:00,000 --> 00:15:05,200 Actually, this one was done with a program called Email Miner from SensePost. 293 00:15:05,200 --> 00:15:07,200 How many saw the SensePost talk today? 294 00:15:08,000 --> 00:15:08,600 Okay. 295 00:15:09,160 --> 00:15:17,400 SensePost has a really cool tool called BidiBlah, which they released today, and they do a lot of things to actually do open source information gathering about targets using Google. 296 00:15:17,400 --> 00:15:21,640 Basically, what I'm doing here is, I'm showing you some of what they do behind the scenes. 297 00:15:22,240 --> 00:15:28,060 You know, there's nothing terribly technical about it, but it's an interesting way to actually profile a target. 298 00:15:28,520 --> 00:15:33,020 So, lots of email addresses, we troll through more results, we get more hits. 299 00:15:33,020 --> 00:15:37,700 I threw this in there because it's just funny, and I like ripping stuff out of people's books. 300 00:15:38,680 --> 00:15:43,980 Other places to find email addresses, how about Excel spreadsheets called email.xls? 301 00:15:44,900 --> 00:15:46,900 Yeah, I like that one. 302 00:15:46,900 --> 00:15:48,860 How about Outlook address books? 303 00:15:49,720 --> 00:15:51,140 Yeah, you name it, it's in there. 304 00:15:51,140 --> 00:15:55,340 How about registry files that actually have internet account management? 305 00:15:55,720 --> 00:15:57,720 Pop three passwords in there. 306 00:15:57,760 --> 00:15:59,020 All sorts of places. 307 00:15:59,060 --> 00:16:08,020 Well, the same thing can actually be done to map a network, and this gets a little deeper, but the process of actually mapping out a network might look something like this. 308 00:16:08,020 --> 00:16:12,860 You get a list of targets, you find related targets, perhaps outside that domain. 309 00:16:12,860 --> 00:16:15,600 Those of you that saw SensePost talk sort of know where this is going. 310 00:16:15,700 --> 00:16:19,020 You expand that list of targets using a couple different methods. 311 00:16:19,020 --> 00:16:22,000 We're going to look at a couple different ways to do this. 312 00:16:22,000 --> 00:16:28,100 You verify those targets, you discover more targets, and you do vitality scans to see if they're up. 313 00:16:28,100 --> 00:16:29,860 That's sort of how the process works. 314 00:16:29,920 --> 00:16:32,700 Let's look at some interesting ways to do this. 315 00:16:32,700 --> 00:16:34,500 First, locating targets. 316 00:16:34,500 --> 00:16:36,620 Some quick ways to locate targets. 317 00:16:36,860 --> 00:16:38,360 Lots of stuff in there. 318 00:16:38,360 --> 00:16:42,920 Your eyes are probably all drawn to the last one, which, yes, it does say scraping turds. 319 00:16:44,560 --> 00:16:47,740 I don't know where the turds and the poo and all that stuff is coming from. 320 00:16:47,740 --> 00:16:51,360 It really is not a statement about me personally, it's just how it came out. 321 00:16:51,540 --> 00:16:53,020 Okay, that was a bad way to say that. 322 00:16:54,660 --> 00:16:55,860 All right, you get the idea. 323 00:16:56,020 --> 00:16:59,100 All right, very simple query, site colon microsoft.com. 324 00:16:59,100 --> 00:17:04,100 Again, we're having a nice little conversation with Google, trying to do recon on microsoft.com. 325 00:17:04,260 --> 00:17:08,440 Site microsoft.com lists every Google page from microsoft.com. 326 00:17:08,440 --> 00:17:09,860 All right, pretty straightforward. 327 00:17:09,980 --> 00:17:11,660 Problem is, the results suck. 328 00:17:11,660 --> 00:17:15,320 If you're trying to acquire targets, the targets are rather limited. 329 00:17:15,320 --> 00:17:20,280 Top of the list is www.microsoft.com, which the entire freaking planet knows exists. 330 00:17:20,320 --> 00:17:27,340 As an attacker, we don't care about www.microsoft.com, so bottom line is, we want to get rid of it. 331 00:17:27,340 --> 00:17:28,780 So we change our query. 332 00:17:28,900 --> 00:17:33,400 Site microsoft.com minus site screensaver.microsoft.com. 333 00:17:35,080 --> 00:17:41,700 Okay, and as you can see, when this query comes back, we're not looking at www's anymore, we're getting interesting target names. 334 00:17:41,820 --> 00:17:47,360 So an attacker sort of scrapes these target names to the side and, you know, collects them. 335 00:17:47,360 --> 00:17:48,920 Gets to be a little bit tedious. 336 00:17:49,160 --> 00:17:55,640 This isn't a great way to do it, because you run into a query cap of 32 search items in a query. 337 00:17:55,760 --> 00:18:01,980 So you keep reducing sites from this list, eventually you're going to run into into a limit, but you're getting interesting results. 338 00:18:01,980 --> 00:18:05,920 Research.microsoft.com, partner.microsoft.com, blah blah blah. 339 00:18:06,260 --> 00:18:08,080 All right, some other ways to do it. 340 00:18:08,080 --> 00:18:09,580 Back to regular expressions. 341 00:18:09,900 --> 00:18:22,580 Perform the query in an automated fashion, slamming all the results of the html into a big file, and use regular expressions to go through that file to look for urls that end in microsoft.com. 342 00:18:22,580 --> 00:18:29,160 Okay, so you're still using google to do the actual query, but you're not necessarily limited by google's search functionality. 343 00:18:29,280 --> 00:18:31,340 Okay, you can look for more interesting stuff. 344 00:18:31,540 --> 00:18:42,100 Okay, now you can not only do this with the search result page itself, but you can do this with the entire html content of the website as well, without throwing a single packet to the target. 345 00:18:42,220 --> 00:18:43,780 We'll talk about that next. 346 00:18:45,220 --> 00:18:46,500 All right, blah blah blah. 347 00:18:46,500 --> 00:18:48,240 You run the thing, you get stuff. 348 00:18:48,420 --> 00:18:50,240 A big so what slide here. 349 00:18:50,240 --> 00:18:52,960 Yeah, I know there's other ways to actually recon targets. 350 00:18:52,960 --> 00:18:57,100 The hook here is actually doing recon on the targets without sending packets to it. 351 00:18:57,100 --> 00:18:58,600 So that's where we're going to go. 352 00:18:58,720 --> 00:19:00,540 Now that you've read all that, next slide. 353 00:19:01,560 --> 00:19:03,440 All right, automated crawling. 354 00:19:03,440 --> 00:19:04,980 Google frowns on it. 355 00:19:04,980 --> 00:19:09,500 So we could use some other techniques to actually get things done. 356 00:19:09,500 --> 00:19:13,900 I think I'm probably going to skip all of this because... blah blah. 357 00:19:13,900 --> 00:19:15,260 I do want to highlight this. 358 00:19:15,260 --> 00:19:17,320 This is a nice tool again by SensePost. 359 00:19:17,320 --> 00:19:18,880 And you can download this stuff. 360 00:19:18,880 --> 00:19:21,900 Biddyblah is a very powerful tool. 361 00:19:21,900 --> 00:19:24,420 I encourage you to go to SensePost's site and check it out. 362 00:19:24,420 --> 00:19:37,460 But if you're not necessarily interested in all the functionality of Biddyblah, but you're more interested in the techniques that Biddyblah uses to actually map out a network, and you want to expand on that, some of these tools are available from SensePost as well. 363 00:19:37,460 --> 00:19:47,020 Bottom line, run this Perl script with a domain name, comes back and gives you a list of subdomains, DNS names and target names using Google queries. 364 00:19:47,020 --> 00:19:48,280 Pretty straightforward. 365 00:19:49,400 --> 00:19:50,060 Okay. 366 00:19:50,060 --> 00:19:51,860 On to the turd thing. 367 00:19:52,740 --> 00:19:57,600 I came up with another term, Google turds, which Google hasn't adopted yet either. 368 00:19:58,360 --> 00:20:03,720 I think it's because turds are usually brown and Google doesn't use brown in any of their color schemes. 369 00:20:04,060 --> 00:20:05,880 Not to be too graphic about it. 370 00:20:05,880 --> 00:20:09,180 But a Google turd is a Google query that's broken. 371 00:20:09,340 --> 00:20:11,020 It shouldn't return results. 372 00:20:11,020 --> 00:20:13,060 It's syntactically incorrect. 373 00:20:13,060 --> 00:20:15,280 Can anybody tell me what's wrong with this query? 374 00:20:15,280 --> 00:20:16,800 Site colon NASA. 375 00:20:19,220 --> 00:20:20,560 There's no .gov. 376 00:20:20,560 --> 00:20:20,840 Right. 377 00:20:20,840 --> 00:20:22,020 It's a busted query. 378 00:20:22,020 --> 00:20:23,640 Problem is, we got results. 379 00:20:23,640 --> 00:20:25,580 That's the heart and soul of a Google turd. 380 00:20:25,580 --> 00:20:27,540 Busted query that gets results. 381 00:20:27,640 --> 00:20:29,600 These results could be interesting. 382 00:20:29,680 --> 00:20:31,620 We could do something with these results. 383 00:20:31,620 --> 00:20:33,760 Lots of ways that these could have shown up. 384 00:20:34,440 --> 00:20:37,580 Syntax problems on the site when it was crawled, yada, yada, yada. 385 00:20:37,580 --> 00:20:39,860 But we'll come back to this in a little bit. 386 00:20:40,820 --> 00:20:41,640 All right. 387 00:20:42,440 --> 00:20:47,840 Also, there's a lot to be gotten from relationships between sites that you can actually use with Google. 388 00:20:47,840 --> 00:20:49,480 I'm going to go really light on this, too. 389 00:20:49,480 --> 00:21:03,380 But the bottom line is, if you can scrape all of this stuff from Google and get information about Microsoft.com, how much interest do you have in finding other sites other than Microsoft.com that could potentially be targets that are owned by the same entity? 390 00:21:03,720 --> 00:21:05,840 It's something you probably want to do. 391 00:21:05,940 --> 00:21:11,340 Well, in order to figure out relationships between sites, we need to have somewhat of a process. 392 00:21:11,340 --> 00:21:18,660 For example, if I post a link on my site to Microsoft.com, does that mean that there's a relationship between Microsoft and me? 393 00:21:20,020 --> 00:21:20,860 No. 394 00:21:20,880 --> 00:21:23,580 Anybody can throw up a link to Microsoft.com. 395 00:21:23,620 --> 00:21:25,340 Now, let's ask it another way. 396 00:21:25,340 --> 00:21:30,860 If Microsoft also has a link to me, is there possibly a relationship now? 397 00:21:31,480 --> 00:21:32,240 Possibly. 398 00:21:32,240 --> 00:21:34,200 In fact, it's fairly likely. 399 00:21:34,200 --> 00:21:36,580 This is the heart and soul of link weighting. 400 00:21:37,060 --> 00:21:40,960 Weighing links to and from sites to determine possible relationships. 401 00:21:41,040 --> 00:21:45,720 The bottom line here is that the two-way link weighs more than a one -way link. 402 00:21:45,720 --> 00:21:51,220 And you can use all of this information when you're scraping all this data from Google to figure out relationships. 403 00:21:51,840 --> 00:21:54,160 I just said that. 404 00:21:54,960 --> 00:21:58,700 Now, the question is, what can we use to determine links to and from a target? 405 00:21:58,780 --> 00:22:02,460 The answer for everything in this talk is Google, the link operator. 406 00:22:03,200 --> 00:22:08,680 Link www.microsoft.com shows all the sites that link to Microsoft's website. 407 00:22:08,840 --> 00:22:11,040 The problem is the results. 408 00:22:11,120 --> 00:22:13,840 For example, MapQuest, second in the list. 409 00:22:13,840 --> 00:22:16,520 Microsoft have anything to do with MapQuest? 410 00:22:17,480 --> 00:22:19,240 I hope not, do they? 411 00:22:20,260 --> 00:22:21,100 I don't know. 412 00:22:21,100 --> 00:22:24,400 Well, bottom line is the results are pretty bad. 413 00:22:24,780 --> 00:22:30,060 Also, link doesn't play well with other operators, so link is very limited for these purposes. 414 00:22:30,320 --> 00:22:35,160 If you try to use link and site together, the query is busted. 415 00:22:35,160 --> 00:22:36,220 It doesn't work. 416 00:22:36,880 --> 00:22:39,880 So, blah, blah, blah. 417 00:22:40,420 --> 00:22:41,980 Again, SensePost to the rescue. 418 00:22:41,980 --> 00:22:49,900 They have all sorts of tools that do stuff like this, and I'm really giving them a lot of press, because they deserve it. 419 00:22:50,040 --> 00:23:01,740 They've taken a lot of these really cool ideas with Google, and they haven't done DEF CON and Black Hat talks on them necessarily, but they've quietly implemented them into various tools that make sense. 420 00:23:01,740 --> 00:23:05,320 One of the tools is Bile, the bi-directional link extractor. 421 00:23:05,340 --> 00:23:08,960 Basically, Bile automates the process of figuring out link weights. 422 00:23:08,960 --> 00:23:10,280 Let me give you an example. 423 00:23:11,580 --> 00:23:13,900 For example, who is SensePost? 424 00:23:14,040 --> 00:23:16,540 You guys probably know, but let's pretend we don't. 425 00:23:16,540 --> 00:23:30,720 A Google query doesn't give you much of an answer, but if we throw SensePost.com into Bile, we find out that there are lots of links to SensePost.com from lots of different servers, and here's where they are. 426 00:23:31,800 --> 00:23:39,320 We also go through, and Bile will link weight each of those relationships to figure out which is the strongest, and this is the output that you get. 427 00:23:39,320 --> 00:23:41,480 You'll notice SensePost.com is at the top. 428 00:23:41,480 --> 00:23:45,460 It's the most strongly related site to SensePost that's out there. 429 00:23:45,460 --> 00:23:49,940 The second is BlackHat.com, and these are sorted order. 430 00:23:49,940 --> 00:23:53,380 Then we've got PacketStorm Security, SecurityLab.ru. 431 00:23:53,380 --> 00:23:59,660 Bottom line is, you can tell pretty quickly that SensePost has something to do with security, and they're involved in the security community. 432 00:23:59,660 --> 00:24:01,380 It's all done with Google queries. 433 00:24:01,380 --> 00:24:03,100 Google queries and link weighting. 434 00:24:04,140 --> 00:24:04,880 All right. 435 00:24:04,880 --> 00:24:05,900 Interesting question. 436 00:24:05,900 --> 00:24:09,940 Can Google be used to locate hosts that Google doesn't even know about? 437 00:24:10,660 --> 00:24:12,380 Sort of a brain teaser. 438 00:24:13,920 --> 00:24:14,960 Sure. 439 00:24:15,780 --> 00:24:18,160 But we'll need to do some background stuff first. 440 00:24:18,240 --> 00:24:19,300 Skipping that. 441 00:24:19,300 --> 00:24:19,940 All right. 442 00:24:20,020 --> 00:24:22,300 So we're at the point where we've located some targets. 443 00:24:22,300 --> 00:24:24,140 We've seen some interesting ways to locate targets. 444 00:24:24,140 --> 00:24:25,680 How about expanding the target list? 445 00:24:25,680 --> 00:24:28,160 Here's some ways that you can expand target lists. 446 00:24:28,300 --> 00:24:30,480 We'll talk about just a couple of them. 447 00:24:31,280 --> 00:24:37,280 If you've got a list of hosts, if you've got a domain, foo.com, you could brute force the domain with NSLookups. 448 00:24:37,720 --> 00:24:40,020 You could use every known word in a word list. 449 00:24:40,020 --> 00:24:42,520 You could do all sorts of interrelationship stuff. 450 00:24:42,560 --> 00:24:44,620 But that stuff doesn't always work. 451 00:24:44,820 --> 00:24:45,800 You could do fuzzing. 452 00:24:45,800 --> 00:24:53,620 For example, if I churn up BHST03.Verizon.com, I could fuzz that and see if BHST02 is there. 453 00:24:53,620 --> 00:24:56,380 Same with something like www33. 454 00:24:56,380 --> 00:24:59,700 It's basic fuzzing to help us expand our host list. 455 00:24:59,840 --> 00:25:00,460 Okay. 456 00:25:00,460 --> 00:25:01,680 You can also do it with names. 457 00:25:01,680 --> 00:25:03,120 Let's say we get these two hosts. 458 00:25:03,120 --> 00:25:05,820 Apple.foo.com and orange.foo.com. 459 00:25:05,820 --> 00:25:08,920 Can anybody give me some other hosts that might exist? 460 00:25:09,560 --> 00:25:11,720 Mango is the first answer. 461 00:25:12,020 --> 00:25:13,060 Slick. 462 00:25:14,900 --> 00:25:16,700 Caliente is not a fruit, is it? 463 00:25:17,200 --> 00:25:18,360 Passion fruit. 464 00:25:18,760 --> 00:25:20,580 You were at Black Hat, weren't you? 465 00:25:20,720 --> 00:25:23,180 That was the number one answer was passion fruit. 466 00:25:23,700 --> 00:25:27,180 It's much more passionate than the ones I came up with, but there you go. 467 00:25:27,260 --> 00:25:27,900 Cherry. 468 00:25:27,900 --> 00:25:29,100 I came up with mango. 469 00:25:30,040 --> 00:25:30,520 Watermelon. 470 00:25:30,520 --> 00:25:30,920 Pear. 471 00:25:30,920 --> 00:25:31,360 Strawberry. 472 00:25:31,360 --> 00:25:31,720 Banana. 473 00:25:31,720 --> 00:25:33,240 Didn't come up with passion fruit. 474 00:25:33,360 --> 00:25:33,900 All right. 475 00:25:33,900 --> 00:25:40,340 So you've done some, you know, basic expansion, some really basic fuzzing to figure out more targets that might be out there. 476 00:25:40,560 --> 00:25:40,900 All right. 477 00:25:40,900 --> 00:25:43,400 Let's figure out a more interesting way to do it. 478 00:25:43,400 --> 00:25:45,540 Anybody here use Google Sets? 479 00:25:46,560 --> 00:25:47,720 Okay, good. 480 00:25:47,800 --> 00:25:56,160 Google Sets actually takes a couple words, okay, that are related and tells you the next words in the series that might appear using Google's database. 481 00:25:56,600 --> 00:26:02,780 So for example, apples and oranges fired into Google Sets gives you a list that looks like this. 482 00:26:03,380 --> 00:26:12,360 We've got stuff like, we got here, we got pears and strawberries and blueberries and figs and kiwis. 483 00:26:12,360 --> 00:26:13,680 It's a pretty good list. 484 00:26:13,840 --> 00:26:14,440 Okay. 485 00:26:14,620 --> 00:26:18,420 Could fairly easily expand these, but let's try another exercise. 486 00:26:18,940 --> 00:26:21,940 We've got investor and foundation as host names. 487 00:26:21,940 --> 00:26:23,200 Expand those. 488 00:26:26,200 --> 00:26:28,680 Okay, I'll cut to the chase because there's not a lot of answers coming. 489 00:26:29,000 --> 00:26:29,920 It's tough. 490 00:26:29,920 --> 00:26:33,700 So let's throw it into Google Sets and see what Google Sets has to come up with. 491 00:26:33,700 --> 00:26:45,220 Investor and foundation thrown into Google Sets gives us this awesome list of things like the word board members and business directory and metal roof. 492 00:26:47,000 --> 00:26:51,180 And owner occupied at what Foga Fopa. 493 00:26:52,080 --> 00:26:53,140 Man, you guys are dumb. 494 00:26:53,140 --> 00:26:54,980 You didn't come up with any of these. 495 00:26:56,280 --> 00:27:01,560 Well, the problem is Google Sets did its best. 496 00:27:01,740 --> 00:27:05,260 The bottom line is here, we didn't give it related terms. 497 00:27:05,280 --> 00:27:10,820 So the next question I pose to you is, armed with a list of words, we're thinking host names here, right? 498 00:27:10,820 --> 00:27:13,680 How can we find the ones that are the most related? 499 00:27:13,960 --> 00:27:17,500 The answer for everything in this talk is thank you. 500 00:27:18,380 --> 00:27:19,120 All right. 501 00:27:19,340 --> 00:27:20,900 Here's one way to do it. 502 00:27:20,900 --> 00:27:25,000 Take the host names, every host name that you have, and split them up into unique pairs. 503 00:27:25,000 --> 00:27:28,400 For example, apple, pickle, orange, and Fred are host names. 504 00:27:28,400 --> 00:27:30,100 Break them up into unique pairs. 505 00:27:30,100 --> 00:27:32,880 Apple, pickle, apple, orange, apple, Fred, blah, blah, blah. 506 00:27:32,920 --> 00:27:38,100 And now we Google for each pair to get something that looks like this. 507 00:27:38,520 --> 00:27:38,840 Okay. 508 00:27:38,840 --> 00:27:45,400 Based on the Google results, which of these somewhat related host names are the most closely related? 509 00:27:47,720 --> 00:27:48,800 Apple and orange. 510 00:27:48,800 --> 00:27:50,380 It has the most hits. 511 00:27:50,380 --> 00:27:51,980 It's a reasonable assumption. 512 00:27:52,000 --> 00:27:59,040 So you get a massive host list, feed it into unique pairs through Google queries, and get Google to tell you which ones are the most closely related. 513 00:27:59,040 --> 00:28:06,040 And then you throw those two into Google sets, or you automate this process, like we have on the bottom left, to get the same results. 514 00:28:06,040 --> 00:28:08,180 Bottom line, apple and orange wins. 515 00:28:08,180 --> 00:28:11,300 Google figured out which of the words was most closely related. 516 00:28:11,360 --> 00:28:13,480 So let's pull it together. 517 00:28:15,580 --> 00:28:17,460 I'll pull it together with pictures. 518 00:28:18,200 --> 00:28:18,840 All right. 519 00:28:18,840 --> 00:28:20,220 We get a list of targets. 520 00:28:20,220 --> 00:28:21,780 Here's sdsu.edu. 521 00:28:21,780 --> 00:28:23,040 List of targets. 522 00:28:23,140 --> 00:28:28,020 Physics, music, bio, geology. 523 00:28:28,020 --> 00:28:30,060 Okay, they're college courses, right? 524 00:28:30,120 --> 00:28:37,940 So let's feed, and this is automated here, let's feed all of these words into Google to come up with the two that are the most closely related. 525 00:28:37,940 --> 00:28:42,800 And we find out that chemistry and physics are, in fact, the two mostly closely related words. 526 00:28:43,040 --> 00:28:54,280 What we do next is feed chemistry and physics into Google sets to get a list of expanded host names to figure out, and then stick them on to sdsu.edu. 527 00:28:54,780 --> 00:28:59,120 And what we're gonna do is send a single NS lookup to figure out if these hosts resolve. 528 00:28:59,180 --> 00:29:00,600 Again, all automated. 529 00:29:00,920 --> 00:29:03,560 And as you see, a lot of the hosts resolved. 530 00:29:03,760 --> 00:29:04,860 Okay, pretty nice. 531 00:29:05,180 --> 00:29:11,160 So we can also go in, we can do links to see if they have, you know, if they're web servers, you can do port scanning, whatever. 532 00:29:11,240 --> 00:29:19,540 Now, the only reason I'm checking to see if these are web servers is because of this very chic and and very hard to read table. 533 00:29:20,240 --> 00:29:24,400 Now, the table is interesting, because it basically sums up what we found. 534 00:29:24,400 --> 00:29:27,420 13 new hosts that we didn't have before. 535 00:29:27,700 --> 00:29:33,580 Okay, we found 13 new hosts using this method, seven of which Google knew nothing about. 536 00:29:34,040 --> 00:29:36,400 Google couldn't find any of these hosts. 537 00:29:36,840 --> 00:29:39,380 Four of those hosts were web servers. 538 00:29:39,460 --> 00:29:41,740 So Google didn't even know about these web servers. 539 00:29:41,740 --> 00:29:47,680 So the answer to the question is, can you use Google to find hosts that Google doesn't even know about is yes. 540 00:29:47,680 --> 00:29:48,400 Thank you. 541 00:29:48,640 --> 00:29:49,380 All right. 542 00:29:49,660 --> 00:29:50,920 Blah, blah, blah. 543 00:29:52,000 --> 00:29:52,760 Verifying. 544 00:29:52,820 --> 00:29:55,560 I get a little bit into verifying. 545 00:29:55,580 --> 00:30:01,420 Bottom line is you can use lots of stuff to verify the targets, but we're gonna try to do it in a more stealthy fashion. 546 00:30:02,000 --> 00:30:02,880 One more example. 547 00:30:02,880 --> 00:30:04,940 Remember the NASA sites, all right? 548 00:30:05,040 --> 00:30:07,040 What was missing from the end of them? 549 00:30:07,720 --> 00:30:08,440 .gov. 550 00:30:08,440 --> 00:30:11,060 74 results in this Google turd query. 551 00:30:11,100 --> 00:30:15,980 If I slap .gov onto the end of each of these hosts, how many of them do you think resolve? 552 00:30:16,920 --> 00:30:18,100 All of them. 553 00:30:18,900 --> 00:30:25,140 Okay, the bottom line is these were posted to the web, they were broken, we fixed them, we resolved them, we found targets. 554 00:30:25,220 --> 00:30:30,520 Okay, point is lots of ways to get interesting host information without sending any packets to the target. 555 00:30:31,280 --> 00:30:32,040 All right. 556 00:30:32,120 --> 00:30:34,220 All right, now about zero packet scanning. 557 00:30:34,220 --> 00:30:36,660 This is sort of meant as a joke. 558 00:30:38,280 --> 00:30:41,180 Zero packet scanning does not mean passive. 559 00:30:41,180 --> 00:30:43,320 Okay, I'm not talking about passive here. 560 00:30:43,320 --> 00:30:48,660 I'm not talking, I'm talking about zero packets from you, the source, to your target. 561 00:30:48,660 --> 00:30:55,300 So let's try to figure out some ways that we can actually do some recon without sending any packets directly to the target. 562 00:30:55,640 --> 00:30:58,840 It's about having fun with Google, remember when security was fun? 563 00:30:58,880 --> 00:31:02,060 Okay, so please no comments about the zero packet thing. 564 00:31:02,280 --> 00:31:03,080 All right. 565 00:31:03,320 --> 00:31:08,200 For example, DNS resolution isn't a big deal. 566 00:31:08,840 --> 00:31:12,880 Okay, port scanning is, that flags IDS monitor, so we don't want to do that crap. 567 00:31:13,160 --> 00:31:16,140 So let's find some interesting ways to get Google to help us out. 568 00:31:16,140 --> 00:31:20,200 Here you go, one Google query that finds forms that look like this. 569 00:31:20,420 --> 00:31:26,460 This form lets you send an email to somebody from somebody with a subject and a body and it comes from their web server. 570 00:31:26,640 --> 00:31:30,480 You do one Google query, you find this form, you fire off email from them. 571 00:31:31,200 --> 00:31:32,180 Isn't this fun? 572 00:31:32,860 --> 00:31:37,040 One Google query, find sites that'll gladly run the finger command for you. 573 00:31:37,520 --> 00:31:40,880 Notice I said that without opening myself to any finger jokes. 574 00:31:42,680 --> 00:31:46,440 One Google query, find sites that will actually ping for you. 575 00:31:47,120 --> 00:31:51,860 One Google query that will find sites that will gladly port scan a target for you. 576 00:31:53,080 --> 00:31:54,940 Zero packets from you to the target. 577 00:31:54,940 --> 00:31:59,980 You proxy your connection through this site, they're doing the port scanning, plus you're coming in proxy. 578 00:32:00,580 --> 00:32:01,400 Fun. 579 00:32:02,080 --> 00:32:02,960 How about this one? 580 00:32:02,960 --> 00:32:05,100 This one's a little long-winded, so I'm going to blow through it. 581 00:32:05,100 --> 00:32:08,000 Another site that lets you do port scanning, limited ports. 582 00:32:08,000 --> 00:32:09,500 See the limited ports? 583 00:32:09,660 --> 00:32:13,380 Here we go with more 1984 eliteness. 584 00:32:13,660 --> 00:32:17,620 What do you think the colon 81 on the end of that URL refers to? 585 00:32:18,260 --> 00:32:19,360 A port. 586 00:32:19,360 --> 00:32:23,200 And what do you suppose that little red dot that says port closed means? 587 00:32:24,420 --> 00:32:25,620 Port closed. 588 00:32:25,620 --> 00:32:31,680 So let's change the URL to 80 and we get a green dot which means port open. 589 00:32:32,020 --> 00:32:45,500 So we write a little script that actually fires through all those URLs to see which image is returned and we have an automated solution that actually bounces a port scan off of another site, zero packets from you to the target, you get your port scan at their expense. 590 00:32:45,760 --> 00:32:54,920 For example, you can even build an HTML page on your local workstation that looks like this if you really must have green and red dots to break into a site. 591 00:32:55,940 --> 00:32:57,640 Some of you do and that's okay. 592 00:32:59,380 --> 00:33:02,420 How about one Google query to find open proxy servers? 593 00:33:02,440 --> 00:33:07,740 Okay, when you run out of proxy servers to bounce all this crap off of, fire off a Google query and find some more. 594 00:33:08,340 --> 00:33:10,460 Open reverse squid proxies. 595 00:33:10,580 --> 00:33:14,360 Another CGI proxy, one query to find CGI proxies. 596 00:33:14,700 --> 00:33:16,440 Okay, this one's kind of fun. 597 00:33:16,440 --> 00:33:25,720 Please choose URL slash encoding and then they give you a little box and you put a URL in there and what do you know it bounces you to a site proxy style. 598 00:33:25,720 --> 00:33:29,680 Here I am viewing my website through a Chinese government proxy. 599 00:33:31,580 --> 00:33:32,900 Oh, did I say Chinese? 600 00:33:32,900 --> 00:33:36,340 I meant I was thinking about Chinese food and it just came out. 601 00:33:37,100 --> 00:33:39,280 Next slide, not the food, but the word. 602 00:33:39,920 --> 00:33:42,860 All right, here's one Google query that actually does all this stuff for you. 603 00:33:42,860 --> 00:33:44,080 Sites that'll do all this crap. 604 00:33:44,080 --> 00:33:48,120 Trace route, who is, fingers, NS lookup, hosts, DNS queries, digs. 605 00:33:48,120 --> 00:33:51,160 Again, one Google query, this site will do your bidding. 606 00:33:51,820 --> 00:33:54,340 Okay, this one will find NQT. 607 00:33:54,340 --> 00:33:55,880 I covered NQT last year. 608 00:33:55,880 --> 00:33:58,120 It's got some interesting limited functionality. 609 00:33:58,360 --> 00:34:09,700 But bottom line here is Jimmy Neutron actually turned this into a nice little Perl script to bounce scans off of an NQT server so that you can do all this stuff off of NQT. 610 00:34:09,700 --> 00:34:13,440 These tools are available from my website if you want to take a look at those. 611 00:34:14,020 --> 00:34:15,020 Okay, I'm skipping this one. 612 00:34:15,020 --> 00:34:17,420 This is basically a Java SSH client. 613 00:34:17,800 --> 00:34:21,560 You can do all sorts of nasty stuff with this, but it's from your machine. 614 00:34:21,580 --> 00:34:22,800 It's just kind of neat. 615 00:34:22,800 --> 00:34:24,360 So skip that. 616 00:34:24,740 --> 00:34:26,280 Oh, wait, come back. 617 00:34:27,000 --> 00:34:30,560 Is there a way to anonymously web crawl a target without pounding it with packets? 618 00:34:30,560 --> 00:34:31,360 Of course. 619 00:34:32,360 --> 00:34:34,620 How many of you have ever used a cache link? 620 00:34:35,160 --> 00:34:36,460 Keep your hands up. 621 00:34:37,020 --> 00:34:40,940 How many of you have ever read the banner at the top of the cache page? 622 00:34:42,300 --> 00:34:43,100 Good. 623 00:34:43,160 --> 00:34:45,880 I got to say the average is better than it was at Black Hat. 624 00:34:46,120 --> 00:34:46,880 All right. 625 00:34:46,880 --> 00:34:52,740 Now, for those of you that haven't read this page, shame on you, but let's figure out what happens when you click on a cache link. 626 00:34:52,800 --> 00:34:54,960 All right, here's a TCP dump. 627 00:34:54,960 --> 00:34:56,200 We click on a cache link. 628 00:34:56,200 --> 00:34:59,940 We make a connection to, in this case, the Frack website and to Google. 629 00:35:00,260 --> 00:35:02,220 Okay, so got some stuff going on. 630 00:35:02,220 --> 00:35:05,780 Question is, what was that that happened behind the scenes? 631 00:35:05,780 --> 00:35:06,760 What is this? 632 00:35:07,320 --> 00:35:08,220 It's an image. 633 00:35:08,480 --> 00:35:15,680 Okay, so up in the little header, Google was kind enough to tell you this cache page may reference images which are no longer available. 634 00:35:15,680 --> 00:35:18,080 Click here for the cache text only. 635 00:35:18,200 --> 00:35:20,940 So let's click here for the cache text only. 636 00:35:20,940 --> 00:35:21,980 Sniff it again. 637 00:35:21,980 --> 00:35:25,500 This time the entire conversation is between me and Google. 638 00:35:25,780 --> 00:35:31,440 We got the HTML off the site safely from Google without touching the Frack website. 639 00:35:31,440 --> 00:35:36,880 Bottom line here is it's very easy to get HTML content without sending any packets to the target. 640 00:35:36,880 --> 00:35:39,880 What you do with that content is wide open. 641 00:35:39,880 --> 00:35:41,600 Run regular expressions through it. 642 00:35:41,600 --> 00:35:42,520 Do whatever you want. 643 00:35:42,520 --> 00:35:44,940 Bottom line is you're not touching the target. 644 00:35:44,940 --> 00:35:46,160 You're talking to Google. 645 00:35:47,820 --> 00:35:50,240 Question is, what happened behind the scenes? 646 00:35:50,240 --> 00:35:52,020 Top URL is the cache link. 647 00:35:52,020 --> 00:35:54,260 Bottom URL is the cache text only. 648 00:35:54,260 --> 00:35:55,680 There's only one difference. 649 00:35:55,680 --> 00:35:58,080 It's got and strip equals one on the end. 650 00:35:58,180 --> 00:36:01,400 Okay, so let's see how we would do this in the real world. 651 00:36:01,400 --> 00:36:03,160 Right click on a cache link. 652 00:36:03,300 --> 00:36:05,400 Save the address to the clipboard. 653 00:36:05,400 --> 00:36:07,160 Paste it up to the address bar. 654 00:36:07,160 --> 00:36:09,740 Slap and strip equals one onto the end. 655 00:36:09,740 --> 00:36:13,880 And you're viewing the HTML of the web page without sending any packets to the target. 656 00:36:13,880 --> 00:36:14,860 Easy, right? 657 00:36:15,360 --> 00:36:16,400 No, it's not. 658 00:36:16,400 --> 00:36:18,180 You're supposed to say no, it's not. 659 00:36:18,180 --> 00:36:23,460 Okay, well, how about a Firefox plug-in that actually does this for you? 660 00:36:25,680 --> 00:36:31,740 All right, right click on any URL on any page and you get these nifty little options. 661 00:36:31,740 --> 00:36:33,820 Passive cache Google this link. 662 00:36:33,820 --> 00:36:35,620 What do you think that does? 663 00:36:36,280 --> 00:36:41,540 Okay, very nice plug-in written by Brian Baskins available from our website. 664 00:36:42,100 --> 00:36:43,120 Not from Google. 665 00:36:43,120 --> 00:36:44,100 I'll say Google. 666 00:36:44,520 --> 00:36:49,140 All right, so you right click on the link and it takes you to the passive cache Google image of that page. 667 00:36:49,140 --> 00:36:50,720 You don't have to hit the target. 668 00:36:50,860 --> 00:36:52,840 The one under that is nice too. 669 00:36:52,840 --> 00:36:54,740 Passive cache archive this link. 670 00:36:54,740 --> 00:36:58,460 How about pulling the page out of archive.org to see what it looked like in the past? 671 00:36:58,640 --> 00:37:02,920 Okay, so two very nice options for getting web pages without touching the target. 672 00:37:02,940 --> 00:37:04,160 Right, Firefox. 673 00:37:04,540 --> 00:37:07,940 So yes, you can do zero packet recon against the target. 674 00:37:08,340 --> 00:37:11,600 And we're flying, we're not letting you read, we're going on. 675 00:37:13,400 --> 00:37:14,560 Yeah, I'll talk about this. 676 00:37:14,560 --> 00:37:15,220 This is kind of neat. 677 00:37:15,220 --> 00:37:19,000 I didn't necessarily invent this thing, but it's it's kind of a neat situation. 678 00:37:19,300 --> 00:37:22,900 Let's say you go to a web page that you find in Google and it's down. 679 00:37:22,900 --> 00:37:26,240 You click the cache link and sometimes the cache link's even broken. 680 00:37:26,400 --> 00:37:28,060 Sometimes you get that error message. 681 00:37:28,180 --> 00:37:34,740 Well, the question is, is there any way we can recreate that web page without, you know, without hurting ourselves? 682 00:37:34,740 --> 00:37:36,660 And the answer is cache sliding. 683 00:37:36,660 --> 00:37:41,120 Somebody else came up with this and with all my Google skills I couldn't for the life of me figure out who it was. 684 00:37:41,120 --> 00:37:47,200 So if you know, please tell me so you don't think I'm making this up as my own uber eliteness stuff. 685 00:37:47,240 --> 00:37:48,980 All right, so we have this query. 686 00:37:48,980 --> 00:37:51,620 We can rebuild the web page just from the snippet. 687 00:37:51,620 --> 00:37:53,460 The way you do it is pretty straightforward. 688 00:37:53,680 --> 00:38:03,360 What you do is you find the page that you're looking for, you narrow down the page with a query, and you actually throw words from the snippet on the tail end of your query. 689 00:38:03,660 --> 00:38:05,440 Okay, it's pretty straightforward. 690 00:38:05,440 --> 00:38:11,840 But what you do is you keep sliding your search queries forward so that you can read more and more of the snippet. 691 00:38:11,840 --> 00:38:17,320 So for example, you can see I queried for natives project next to each other, right? 692 00:38:17,320 --> 00:38:20,440 The next query I query for album entitled. 693 00:38:20,660 --> 00:38:23,860 Notice it's showing me before and after my search term. 694 00:38:23,860 --> 00:38:28,100 I'm recreating the web page without the web page even being there. 695 00:38:28,100 --> 00:38:29,440 The cache is gone. 696 00:38:29,440 --> 00:38:30,880 The real web page is gone. 697 00:38:30,880 --> 00:38:35,520 Bottom line is you keep sliding it forward and forward until you recreate the entire web page. 698 00:38:35,680 --> 00:38:37,200 All right, neat stuff. 699 00:38:38,080 --> 00:38:41,740 Just a quick second about this user agent spoofing. 700 00:38:43,520 --> 00:38:47,940 It's entirely possible for you to change your user agent to make your browser look different. 701 00:38:47,940 --> 00:38:51,320 How many of you have ever changed your user agent to Googlebot? 702 00:38:51,380 --> 00:38:52,420 Excellent. 703 00:38:52,420 --> 00:38:54,760 Nobody at Black Hat raised their hands. 704 00:38:55,140 --> 00:38:56,560 That's pretty cool. 705 00:38:56,580 --> 00:39:00,560 Well, surfing the net as Googlebot has some interesting ramifications. 706 00:39:00,560 --> 00:39:08,600 For one, lots of badly configured sites like forums and news sites actually lock people out depending on what their user agent is. 707 00:39:08,600 --> 00:39:11,880 For example, you got this advertising on your site, right? 708 00:39:11,880 --> 00:39:19,420 You want Google to see your advertising and all that garbage and be able to troll through your forum so that it can send visitors your way, all right? 709 00:39:19,420 --> 00:39:22,140 But you want users to actually sign up for an account. 710 00:39:22,140 --> 00:39:26,560 So you block anybody that comes in that doesn't have Googlebot as their user agent. 711 00:39:26,580 --> 00:39:34,180 So if you want to view the site, set your user agent to Googlebot and you traipse right into the site as the Googlebot and get whatever you want. 712 00:39:34,280 --> 00:39:37,200 Now, these people ain't too bright. 713 00:39:38,120 --> 00:39:39,240 I'll be the first to admit it. 714 00:39:39,240 --> 00:39:41,680 This is not security, okay? 715 00:39:41,680 --> 00:39:43,640 I don't think it was meant to be. 716 00:39:43,660 --> 00:39:52,260 And a lot of sites do this cloaking a better way, which is you look at the user agent plus you look at the IP they came from, see if it came from Google. 717 00:39:52,300 --> 00:39:53,820 That's a better way to do it. 718 00:39:53,840 --> 00:39:56,920 But bottom line is you can have an awful lot of fun with this. 719 00:39:57,660 --> 00:40:00,020 All right, the fireworks show. 720 00:40:01,300 --> 00:40:04,660 Welcome to the Google Hacking Showcase 2005. 721 00:40:04,840 --> 00:40:07,480 All you people that are sleeping, wake up now. 722 00:40:08,340 --> 00:40:09,420 There you go. 723 00:40:11,080 --> 00:40:14,080 Let the games begin, the best and worst of this year. 724 00:40:14,360 --> 00:40:16,500 All right, let's start pretty easy. 725 00:40:16,500 --> 00:40:18,040 How about VNC servers? 726 00:40:18,040 --> 00:40:20,260 How many of you have used VNC or know what it is? 727 00:40:20,420 --> 00:40:21,040 Yeah. 728 00:40:21,620 --> 00:40:27,660 You install it on your server, you install a client, you point it at your server, you control the keyboard and the mouse. 729 00:40:27,660 --> 00:40:28,580 It's pretty nice. 730 00:40:28,580 --> 00:40:33,180 It requires a username, it requires a password, it requires you to know the port that it's listening on. 731 00:40:33,200 --> 00:40:46,820 All right, how about one query that finds real VNC servers that will actually send you down a Java-based client that you can use and is also nice enough to fill in the hostname and the port that you should connect to, right? 732 00:40:47,020 --> 00:40:50,080 And one modification to the query, and guess what? 733 00:40:50,080 --> 00:40:53,800 You can find sites that have no username or password associated with them. 734 00:40:53,860 --> 00:40:56,640 One Google query, you're moving the keyboard and the mouse. 735 00:40:57,100 --> 00:41:01,060 Anybody that has doubts about it being called Google Hacking, just go. 736 00:41:01,880 --> 00:41:03,260 All right, thank you. 737 00:41:03,440 --> 00:41:04,440 All right, this one's weak. 738 00:41:04,440 --> 00:41:06,580 Next, print servers. 739 00:41:06,740 --> 00:41:08,000 Dang, got it. 740 00:41:08,260 --> 00:41:10,180 My laptop even thought it was weak. 741 00:41:11,740 --> 00:41:15,680 All right, one query that actually finds access print servers. 742 00:41:15,680 --> 00:41:24,440 Now, print servers are boring little beasts, you know, unless you're FX and those folks that do really ungodly things to printers. 743 00:41:24,660 --> 00:41:26,620 But printers get a really bad rap. 744 00:41:26,620 --> 00:41:29,680 Now, I'm going to show you some more Oday here. 745 00:41:30,200 --> 00:41:32,440 This is really elite stuff. 746 00:41:32,440 --> 00:41:34,080 Press, you should start writing right now. 747 00:41:34,140 --> 00:41:35,580 Five minutes? 748 00:41:35,780 --> 00:41:37,960 All right, let's fly. 749 00:41:37,960 --> 00:41:45,780 All right, the zero day here is you actually click on that little oval right there with your thing that's a mouse, right? 750 00:41:45,780 --> 00:41:53,960 You click the left button with your finger and you aim it at that little oval that says configuration wizard and what do you think happens? 751 00:41:54,740 --> 00:41:56,280 It orders Chinese. 752 00:41:56,280 --> 00:41:57,320 No, not really. 753 00:41:57,360 --> 00:41:59,440 You enter configuration management. 754 00:41:59,440 --> 00:42:01,140 How about webcams? 755 00:42:01,140 --> 00:42:02,780 I hate freaking webcams. 756 00:42:02,780 --> 00:42:05,360 These webcams, however, are really interesting. 757 00:42:05,360 --> 00:42:07,440 This gives shoulder surfing a new name. 758 00:42:09,080 --> 00:42:16,460 This one's nice because it's pointing at big barrels of explosive looking things and it has a laser button there. 759 00:42:16,580 --> 00:42:18,420 All right, so you can shoot the things. 760 00:42:21,160 --> 00:42:24,840 I'm pretty sure that's what, I didn't click it, but all right. 761 00:42:24,840 --> 00:42:27,980 Anyway, this is the inside of a tactical nuclear submarine. 762 00:42:28,540 --> 00:42:29,580 No, not really. 763 00:42:30,540 --> 00:42:32,280 But it's like eBay or something. 764 00:42:32,280 --> 00:42:33,020 I don't know. 765 00:42:33,020 --> 00:42:34,080 Very interesting. 766 00:42:34,620 --> 00:42:35,720 How about this one? 767 00:42:35,720 --> 00:42:37,680 A speed stream DSL router. 768 00:42:37,780 --> 00:42:39,020 Very nice. 769 00:42:39,020 --> 00:42:41,200 Again, here we go with the uber hacker tricks. 770 00:42:41,200 --> 00:42:43,440 Please do not print this in the press. 771 00:42:43,440 --> 00:42:47,860 What you do is you take the mouse, left button again, and you click on that oval. 772 00:42:47,860 --> 00:42:50,540 It says disconnect. 773 00:42:54,810 --> 00:42:56,490 Yeah, what do you think happens? 774 00:42:56,930 --> 00:42:58,470 Yeah, bye-bye. 775 00:42:58,470 --> 00:42:59,270 All right, how about this one? 776 00:42:59,270 --> 00:43:00,130 A Belkin router. 777 00:43:00,130 --> 00:43:02,730 One query finds Belkin routers that are misconfigured. 778 00:43:02,730 --> 00:43:06,010 You can lock them out of their own wireless network for their own safety. 779 00:43:15,700 --> 00:43:16,780 All right, how about this one? 780 00:43:16,780 --> 00:43:19,620 Who can guess the system password on this box? 781 00:43:26,210 --> 00:43:31,470 Yeah, that's bad news. 782 00:43:31,650 --> 00:43:34,090 This is a query that finds a Windows small business server. 783 00:43:34,090 --> 00:43:35,970 Attention, this site is for employee use. 784 00:43:35,970 --> 00:43:38,830 Only public access to our website can be found by clicking here. 785 00:43:38,830 --> 00:43:41,970 So you're supposed to, you know, be there and not here. 786 00:43:41,970 --> 00:43:42,770 But anyway. 787 00:43:43,350 --> 00:43:43,790 All right. 788 00:43:43,790 --> 00:43:44,610 Boring. 789 00:43:44,610 --> 00:43:45,030 Next. 790 00:43:45,030 --> 00:43:46,130 Pivot software. 791 00:43:46,130 --> 00:43:51,410 This one, this Google query lets you find pages that let you set up the administrator user. 792 00:43:52,470 --> 00:43:57,350 And again, left button, little oval, proceed to log in, create an admin account. 793 00:43:57,350 --> 00:43:58,230 Got it. 794 00:43:58,410 --> 00:43:59,050 Boring. 795 00:43:59,050 --> 00:43:59,470 Next. 796 00:43:59,470 --> 00:44:00,270 Printers. 797 00:44:00,290 --> 00:44:03,710 The printers suck unless you can see the print jobs that they're actually printing. 798 00:44:03,750 --> 00:44:04,470 How about these? 799 00:44:04,470 --> 00:44:05,890 Microsoft Word documents. 800 00:44:05,890 --> 00:44:08,950 Some have to do with religion, some have to do with aphrodisiacs. 801 00:44:08,950 --> 00:44:10,970 Problem was it was the same user. 802 00:44:12,650 --> 00:44:13,930 Not sure. 803 00:44:13,930 --> 00:44:16,310 This is like a distributed denial of service. 804 00:44:16,310 --> 00:44:18,990 You find a printer that lets you do all this stuff to it. 805 00:44:18,990 --> 00:44:23,410 You turn on NetWare and AppleTalk at the same time. 806 00:44:25,210 --> 00:44:27,170 It's just, it's just evil. 807 00:44:27,370 --> 00:44:29,590 One query to find firewalls . 808 00:44:29,590 --> 00:44:32,370 How about smoothwall and IP cops that need updating? 809 00:44:32,990 --> 00:44:35,210 Snort IDS front ends. 810 00:44:35,210 --> 00:44:37,650 How many of you know about that Cisco problem? 811 00:44:39,570 --> 00:44:43,070 Yeah, it's, there's a lot of technical stuff into how that works. 812 00:44:43,070 --> 00:44:48,950 You can probably do something similar with a query like this to just find open Cisco devices for people that are stupid. 813 00:44:49,650 --> 00:44:51,090 Open switches. 814 00:44:51,330 --> 00:44:51,850 Yep. 815 00:44:51,970 --> 00:44:53,930 PHP nuke is very nice. 816 00:44:53,930 --> 00:44:55,030 How about this one? 817 00:44:55,030 --> 00:44:57,570 A query that finds PHP nuke sites. 818 00:44:57,570 --> 00:44:59,550 There are no administrator accounts yet. 819 00:44:59,550 --> 00:45:02,910 Proceed to create them by clicking here. 820 00:45:04,010 --> 00:45:08,370 Yeah, for security reasons it is best that you create the super user right now by clicking here. 821 00:45:12,280 --> 00:45:13,800 Parking lot Nazi cam. 822 00:45:13,800 --> 00:45:19,140 This is so you can see the CIO vault over his convertible when he comes into the building from the handicapped parking spot. 823 00:45:19,400 --> 00:45:21,040 Okay, more security cameras. 824 00:45:21,040 --> 00:45:23,700 Multiple camera views including one called Woody. 825 00:45:24,880 --> 00:45:25,680 I didn't click. 826 00:45:25,680 --> 00:45:26,680 I didn't click. 827 00:45:27,440 --> 00:45:29,520 Time-lapse video recorders. 828 00:45:30,120 --> 00:45:31,740 That's not the end of my presentation. 829 00:45:31,740 --> 00:45:34,660 You guys knew I was out of time so you went right to the end of my presentation. 830 00:45:34,960 --> 00:45:36,620 All right, we are very close to the end. 831 00:45:36,740 --> 00:45:38,200 Sorry for the next person. 832 00:45:38,740 --> 00:45:39,660 Very sorry. 833 00:45:40,980 --> 00:45:41,840 Going back. 834 00:45:41,840 --> 00:45:43,080 We're going back. 835 00:45:49,100 --> 00:45:50,280 Okay, let's go to the... 836 00:45:54,870 --> 00:45:56,070 Ah, here we go. 837 00:45:56,230 --> 00:45:57,550 Sorry, it will be worth the wait. 838 00:45:57,550 --> 00:46:00,130 There we go. 839 00:46:00,630 --> 00:46:02,830 All right, I won't press the wrong button again. 840 00:46:02,870 --> 00:46:04,030 One query that lets you find... 841 00:46:05,330 --> 00:46:08,710 I don't know what this is, but I think that stands for master bedroom. 842 00:46:09,730 --> 00:46:10,670 How about this one? 843 00:46:10,670 --> 00:46:21,770 One query that lets you find e-power switches, web-controlled sockets in somebody's house, electrical sockets, Google for the default password, and you get these rectangular buttons, which it's sort of like crypto. 844 00:46:24,670 --> 00:46:28,990 You click the rectangle in this case that says power and restart. 845 00:46:30,070 --> 00:46:31,690 Yeah, all right. 846 00:46:31,690 --> 00:46:32,570 How about this one? 847 00:46:32,570 --> 00:46:37,070 Lots more things to turn off, including things like on and off buttons. 848 00:46:37,070 --> 00:46:38,430 These are ovals, easy to find. 849 00:46:38,430 --> 00:46:40,910 Turn off lamps and motion detectors. 850 00:46:41,290 --> 00:46:46,330 You can even turn off their media rack, their aquarium, and their electric bong. 851 00:46:46,890 --> 00:46:47,470 How 852 00:46:53,930 --> 00:46:56,470 about this one? 853 00:46:56,470 --> 00:46:59,950 One click to turn off somebody's Christmas lights. 854 00:47:00,410 --> 00:47:02,350 It's just rude. 855 00:47:02,550 --> 00:47:03,910 Usernames and passwords. 856 00:47:03,910 --> 00:47:21,110 How about digital camera image dumps from cell phones, Sprint, T-Mobile, Counter-Strike server configs with clear text passwords, MSN contact lists, how about vCalendar files, MSN ccMail mailbox files, open SQL servers, no username or password required, 857 00:47:21,110 --> 00:47:23,210 point and click, own the database. 858 00:47:23,850 --> 00:47:25,450 SQLite, same deal. 859 00:47:25,450 --> 00:47:29,170 Netscape history files, including clear text pop passwords. 860 00:47:29,230 --> 00:47:33,110 And the surfing list, which includes IBM and hotchicks.com. 861 00:47:34,470 --> 00:47:35,910 How about this one? 862 00:47:35,910 --> 00:47:43,210 These are sysprep.in files that actually show the clear text admin password and the product ID for Windows that they use to install it. 863 00:47:43,650 --> 00:47:45,310 All right, that's a good one. 864 00:47:45,730 --> 00:47:46,430 Yeah. 865 00:47:46,430 --> 00:47:50,850 How about IPSec final encryption keys? 866 00:47:50,910 --> 00:47:52,850 VPN user profiles. 867 00:47:52,850 --> 00:47:55,430 Now, VPN is very secure, so these are encrypted. 868 00:47:55,430 --> 00:47:58,390 Unfortunately, though, these are not. 869 00:48:00,050 --> 00:48:02,570 How about Nessus scan output? 870 00:48:02,570 --> 00:48:06,310 Explorer windows, yes, that does say WinNT system 32. 871 00:48:06,310 --> 00:48:09,670 And yes, the oval does read delete. 872 00:48:16,600 --> 00:48:22,720 All right, police reports, sensitive government documents, yes, sensitive government documents are on the web. 873 00:48:22,880 --> 00:48:26,720 How about this one for the FOUO raincoat? 874 00:48:27,100 --> 00:48:29,580 The FOUO ensemble? 875 00:48:29,900 --> 00:48:34,880 The step-by-step instructions for putting on the coat, which should be classified, I think. 876 00:48:35,000 --> 00:48:37,500 And whatever the hell this guy's doing. 877 00:48:39,260 --> 00:48:43,140 I don't know what he's doing, but he's probably smiling, and that's rated a 10. 878 00:48:43,140 --> 00:48:44,060 Yeah. 879 00:48:45,600 --> 00:48:48,280 Government research project, this is Boba Fett. 880 00:48:48,880 --> 00:48:50,840 The Silence of the Lambs guy. 881 00:48:51,740 --> 00:48:55,640 Darth Vader with the drinking attachment. 882 00:48:57,040 --> 00:49:02,620 If Darth Vader's at DEF CON, and he wants to drink, he shouldn't have to show his ugly head now, should he? 883 00:49:02,840 --> 00:49:05,000 All right, so yeah, we got all sorts of stuff. 884 00:49:05,000 --> 00:49:05,640 How about this one? 885 00:49:05,840 --> 00:49:07,320 Authorized user only. 886 00:49:07,320 --> 00:49:09,520 I'm at the end of the presentation again. 887 00:49:09,540 --> 00:49:11,920 Yes, it did say authorized user only. 888 00:49:11,920 --> 00:49:14,180 Do not distribute, do not put on web. 889 00:49:14,180 --> 00:49:17,360 I am completely out of time, but let's do our last two slides here. 890 00:49:18,380 --> 00:49:24,500 For a shirt, can anyone guess what this username and password should be to break in here? 891 00:49:28,840 --> 00:49:29,660 All right. 892 00:49:29,660 --> 00:49:30,420 Very good. 893 00:49:30,420 --> 00:49:30,980 Next one. 894 00:49:30,980 --> 00:49:32,380 Next one's a little bit easier. 895 00:49:32,380 --> 00:49:32,720 How about... 896 00:49:35,040 --> 00:49:36,860 how about... there we go. 897 00:49:38,200 --> 00:49:39,640 Sorry, I'm out of time, guys. 898 00:49:39,740 --> 00:49:40,280 All right. 899 00:49:41,420 --> 00:49:42,300 Yes. 900 00:49:42,400 --> 00:49:44,340 How do you break into this site, folks? 901 00:49:44,340 --> 00:49:47,100 It says admin equals false in the URL. 902 00:49:48,680 --> 00:49:53,560 Yeah, let's change it to admin equals true, and congratulations, you now have access.