start	end	text
3040	8680	All right. Thanks for coming. My name is Johnny Long, in case you're in the wrong spot.
10580	14240	Presentation today is called Google Hacking for Penetration Testers. How many of you have
14240	18580	seen me speak before? Show of hands. Okay. How many of you have seen me speak on the
18580	25860	topic of Google? Okay, cool. Thanks for coming and seeing me speak about Google again. Next
25860	34060	year it'll be different. It'll be Yahoo. I have about an hour and a half talk here,
34620	39160	which I'm told is just not possible. So I'm going to be flying through some stuff early
39160	44180	on. The format of the talk is pretty straightforward. I go through some technical mumbo-jumbo in
44180	48400	the beginning. It's a little bit dry, so for those of you that aren't technical, feel free
48400	53380	to nap then. Because things get interesting towards the end and we have a nice firework
53380	60780	show at the end. So those of you that nap, do it now. Also, after the talk, in the next
60780	64020	room, just on the other side of this wall, we're going to do a book signing for the book
64020	68960	by the same name written by some guy named Johnny that has gotten decent reviews and
68960	73700	has lots of pretty pictures. So you might want to check that out. So I'll be doing a
73700	78280	book sign across the wall. Also, we're going to be doing a contest. This worked out fairly
78280	83940	well for Black Hat. I expect it to work out. Oh, cell phone rules. For every ring of a
83940	89440	cell phone, it's $5 to a charity of my choice. That usually works. We're going to be doing
89440	92860	a live Google hacking contest. For those of you that know a little bit about this topic
92860	98800	and have come armed to actually win some prizes in the form of books from Syngress, I have
98800	103360	two folks in the back that are helping me out. Hey Josh, Josh and Nick, can you put
103360	108360	your hands up? Back here, against the wall. If you guys are interested in entering the
108360	112740	Google hacking contest, here's what we're looking for. Interesting queries that are
112740	118700	not already public, that cough up sensitive information, sort of a gentleman's agreement
118700	123560	that they actually work and that they're actually unique. But here's the deal. To claim your
123560	127040	prize, you need to come up in front of all these people and in front of that camera to
127040	132820	claim your prize. We will have your email address and we'll inform all the other contestants
132820	139240	of your cheating, lying ways. And we will give them your email address, so be warned.
139500	142960	But anyway, seriously, if you guys have some interesting queries that you'd like to send
142960	147040	to the guys in the back, we've got lots of prizes that we'd be happy to hook you up with.
147380	153120	Alright, so let's dig in. This is the part that I'm going to go short on. How many of
153120	162260	you have used Google? Show of hands. Everybody else has to leave, that's it. Alright, how
162260	166460	many of you have used Google with advanced operators? Show of hands. Good, excellent.
166460	171000	So I will go pretty light with this. Advanced operators are pretty straightforward. You
171000	175160	basically put them right in with your query, just like your other search terms. The syntax
175160	180620	is an operator followed by a colon followed by a thing. I'll call it a search term. There's
180620	184700	no space before or after the colon. So let's get an idea of what some of the operators
184700	190680	are. This is ripped right from a Singris book. It's the first time I ever enjoyed copyright
190680	196420	infringement. It felt great. Anyway, you've got all the operators down the left-hand side,
196420	200780	what the operator is, followed by the purpose of the operator, followed by a couple things
200780	204320	that identify where the operator can be used and whether or not it plays nicely with the
204320	207880	other operators. One of the things you'll realize when you start messing with this stuff
207880	212960	is that some operators are just plain nasty. They just don't like to be messed around with.
212980	218020	So this table sort of helps sort things out. But here's how... I'm going to skip this one
218020	224180	because this is a bad demonstration. Here's how advanced operators can work. And by the
224180	230660	way, I have 209 slides. Does anybody have more than that at DEF CON? Sweet. I have PowerPoint
230660	236620	foo. Alright, we will get through them all. Alright, let's use advanced operators to actually
236620	240540	find this page. This is a page from my website. And what I'm going to do is I'm actually going
240540	249960	to define this page with advanced operators. That's true. My PowerPoint foo skills are
249960	257420	gone now. You will be able to get this off my website after the conference. I felt very
257420	262960	uncomfortable pushing the 40 megs worth of Google joy up on my server with all of you
262960	268720	evil people around. After the con, you guys can pick it up. I have yo-yo skills, though.
272990	277730	So let's define this page. Here you go. In title, I hack stuff. Notice we're using a
277730	281710	phrase. We're looking for a phrase in the title. I'm building a Google query here to
281710	290130	define the page. File type, PHP. This is a PHP page. Num range. Num range got a lot of
290130	295570	press last year through no fault of my own. And I still won't describe the evil uses of
295570	301270	num range, but if you haven't figured it out by now, all hope is lost for you. But num
301270	307550	range is absolutely evil. I know you. I think you're going to need to come up here and drink
307550	320710	that if you're bringing it up. Yeah. Come on. Who wants Mudge to sit up here? Okay.
321630	331760	What are you going to do with my DNA? I've already got it elsewhere. None of you heard
331760	338700	that. All right. On with the show. Let's go a little bit farther in text. Navigate in
338700	343020	text is a little bit goofy because in text sort of does what you think Google searching
343020	347100	normally does. It finds stuff in the text of a web page. But the bottom line here is
347100	351940	you throw all of this crap together into one big nasty query and you get something that
351940	356080	looks like this. One result. You've basically used advanced operators to narrow down your
356080	363880	search very efficiently. So there we go. One hit. That's advanced Google searching. I've
363880	368460	gotten a lot of flack about the term Google hacking. So let's show where the line is.
368840	375020	Google hacking basically is looking for pages that look something like this. Can anybody
375020	387720	tell me what this URL might describe? Thank you. Thank you. Thanks so much. Okay. I'm
387720	394400	here in e-commerce, right? Shopping cart. Yeah. I hear credit cards. There you go. Yeah.
394400	397980	This is basically... well, we'll show you what it describes, but here's the query. In
397980	403880	URL admin, in URL orders, file type PHP. It's a nice query. Throw it into Google. You find
403880	407840	pages that look like this. It's the back end of an e-commerce site. It's the administrative
408160	412040	page for an e-commerce site. So you've got customer orders. You've got order amounts.
412040	415760	You've got ship dates. Okay. And then on the bottom right, you can see we've got payment
415760	420380	details including bank information, credit card information. Okay. This is the heart
420380	424180	and soul of Google hacking. It's basically using Google, first of all, to do things that
424180	427940	it wasn't necessarily designed to do, and secondly, find things that aren't necessarily
427940	435880	public. All right. Now, I came up with this interesting term called Google dork, which
435880	442120	by my own definition is a foolish or inept person as revealed by Google. All right. So
442120	446560	the term Google dork has gotten pretty popular despite the fact that Google has not put it
446560	453320	on their web page anywhere. But it's become obvious lately that Google has started blocking
453320	459320	queries. Okay. And I call the blocking of malicious queries the GDDS for the Google
459320	466840	dork detection system. This is just a blurb. I'm going to fly past this. This is basically
466840	471540	legalese so that the white hats in the community don't yell at me for, you know, revealing
471540	477520	this thing. Bottom line is, Google's blocking queries. They've never before stepped into
477520	481980	this game of messing with your queries. Okay. They've been in the ivory, I don't want to
481980	485560	say ivory tower, it's got negative connotations, but they've never jumped into the security
485560	491160	game before until now. Well, the problem that I have with that is that they're not doing
491160	495420	it very well. Let's take a look at why. Anybody run into a page like this when they're doing
495540	501760	a Google query? Show of hands. Anyone? You all are evil. Everyone look around. People
501760	509760	with their hands up are evil. Okay? This screen comes up when you try a malicious query and
509760	513080	Google just doesn't like it. So what we're going to do is we're going to actually try
513080	519520	to bypass this screen. So this was for inurladmin.php. This is what the query looks like in the form
519520	523480	of a URL up at the top. Down the middle, for those of you in the back that can't see, I've
523480	530580	basically highlighted the query part. It says inurl colon admin dot php. Well, here's uber
530580	538260	hacker trick oday of the talk number one. Okay? I've got lots of them. Unfortunately,
538260	544480	this is like oday from like 84. All right. So our first bypass technique involves just
544480	551740	changing the case of any of the words in the query. So how about admin dot capital php?
552840	558260	So what do you think happens when we fire off any of these queries? Lo and behold, it
558260	563020	goes through. Okay? Now, I'm not going to pick on Google too much for this one because
563020	568780	about two days after I talked about this in Japan for Black Hat, magically this got
568780	573700	fixed. Which was cool. I counted that as a personal victory. I was like, all right, well,
573700	580880	let's keep going. So that was round one. Let's talk about round two. Round two is query shifting.
580880	587780	Here's an interesting query. This one is for a index dot php file that has php bb2 somewhere
587780	593960	in the URL. And they block it. Malicious query. So call this query shifting. Basically what I'm
593960	598480	going to do is I'm going to use the same query for all intents and purposes, but I'm going to
598480	605420	use different operators. So I'm going to look for php bb2 in the URL still, a file type of php
605420	611060	and the word index. It's essentially the same query and it goes through. Shift around Google's
611060	616960	operators, make the search a little bit different, it goes through. Query shifting. This one's my
616960	622420	personal favorite. Some of these are getting fixed, like as we speak, some of them are still
622420	631440	lingering, so your mileage may vary. But anyway, powered by php bb gets blocked. Now, this is a
631440	643180	leap. Just wait for it. Check out what you do to get the query to go through.
643180	648360	Okay. Putting spaces between the letters and the word powered lets the query go through.
648360	652880	Now, you would think that this would just not work. Google would take one look at this and go,
652880	658260	you're a frigging idiot. Well, they do it nicely and it would be in pleasing colors that weren't
658260	664040	offensive. But, you know, normally they'd like fix it for you. Well, Google does actually fix
664040	668380	this query for you. They take one look at it and they're like, what you meant to say was powered,
668380	672760	but hold on, let me check the query to see if it's evil. Not evil. Okay, I'm going to fix it
672760	677840	so that I'm searching for what you're looking for and I'm going to search for powered by php bb.
677840	682080	You can tell it's searching for that because down in the actual query results, it highlights the
682080	690720	words powered by php bb. I'm telling you, oday from 84. All right. Here's another example,
690720	695640	same thing, powered by php bb2, blah, blah, blah, throw some spaces in there. It also works if you
695640	702560	throw pluses between the letters in the URL. That's also elite. How many of you have seen this
702560	710660	message? Show of hands. Okay. Those 10 people are really evil. All right. This is the message
710660	715740	that you get when you violate Google's terms of service. That you've all read.
718540	722300	You're laughing at me. I saw a lot of hands. I saw a lot of people in the audience say,
722300	727400	yeah, you're Google users. So how many of you Google users have read the terms of service?
728320	734060	That's what I thought. Yeah. All right. Well, Google's terms of service says don't do
734060	738220	automation. That's the long and short of it. They give you some alternatives. The alternatives sort
738220	743560	of suck. But they say don't do automation. I got this message by actually curling for a Google
743560	749640	query. I used curl. There's my query. Fired it into poo.html, which doesn't mean anything,
749640	755020	by the way. And I viewed the page. And we get this forbidden message. Now, can anybody tell me
755020	759580	exactly what's different between curl and any other web browser that Google might be interested
759580	767480	in? Thank you. Oday. Here we go. How about if you throw a user agent into curl and actually try it
767480	773860	again, what do you think happens? Yeah. Throw a user agent in there. Now, I threw a really nice
773860	777320	user agent in there. I did a little bit of research. Got out my sniffer. I was feeling all
777320	782520	Uber. I'm like, ooh, look at the nice user agent for my browser. Copied into curl. I'm like, yeah,
782520	788620	I'm the man. And then I started thinking, you know, I really can't type as well as I used to.
788620	792860	And I actually looked at my curl command line. I had this typo in there. I actually had a F space
792860	799180	Firefox as my web browser. And then I thought to myself, I wonder what happens if I just throw,
799180	804100	you know, like poo in there as the user agent. What would happen? Take a guess what happens.
804520	808660	It works. All right. So, Google's looking at the user agent, but they don't give a fly and flip
808660	812740	exactly what you put in there. It just has to be in there somewhere, which makes sense. They don't
812740	816720	want to block the newest browsers from getting search results. So, anyway, that's how you get
816720	821580	past some automation. All right. Question is, why do this? Bottom line is, Google's not going to
821580	827180	protect you from evil searches. You got to take the battle into your own hands. All right. Let's
827180	832220	keep moving. I'm going to fly through this, because this is pretty basic stuff. And it was
832220	838240	fluff for the people at Black Hat, because they're not as smart as you guys. Just kidding. All right.
838240	842000	Bottom line is, there's some interesting things you can do if Google queries just don't work out
842000	846360	for you. This is an example of a query looking for email addresses. We're some spam troll, and
846360	851000	we're out there looking for email addresses. So, we look for at gmail.com. Well, Google throws away
851000	855720	the at sign. Okay. The bottom line is, there's lots of data out there in Google that can be
855720	861080	mined very effectively for all sorts of different things, and can be mined in such a way as to not
861080	865660	send any packets to the target that you're trying to get more information about. We'll talk about
865660	871200	anonymity in a minute. Bottom line is, if Google queries don't work for you, and yeah, this is
871200	878420	really elite, too, you know, using a regular expression on an HTML file dump of a query page
878940	883640	gets you the same result. For example, I use links to actually do the same query, pull the results
883640	888740	down, and then I look in that file for gmail addresses using a regular expression. Okay.
888740	893560	Pretty straightforward. But the bottom line is, this is a little bit, you know, it's a little bit
894080	898820	hard doing it this way, you know, with links, but if you search more and more pages, you can actually
898820	904540	get more results. Actually, this one was done with a program called Email Miner from
904540	911040	SensePost. How many saw the SensePost talk today? Okay. SensePost has a really cool tool called
911040	914940	BidiBlah, which they released today, and they do a lot of things to actually do open source
914940	919120	information gathering about targets using Google. Basically, what I'm doing here is, I'm showing you
919120	925240	some of what they do behind the scenes. You know, there's nothing terribly technical about it,
925240	930940	but it's an interesting way to actually profile a target. So, lots of email addresses, we troll
930940	935780	through more results, we get more hits. I threw this in there because it's just funny, and I like
935780	941940	ripping stuff out of people's books. Other places to find email addresses, how about Excel spreadsheets
941940	950760	called email.xls? Yeah, I like that one. How about Outlook address books? Yeah, you name it, it's in
950760	956420	there. How about registry files that actually have internet account management? Pop three
956420	961420	passwords in there. All sorts of places. Well, the same thing can actually be done to map
961540	966440	a network, and this gets a little deeper, but the process of actually mapping out a network
966440	971720	might look something like this. You get a list of targets, you find related targets, perhaps
971720	976260	outside that domain. Those of you that saw SensePost talk sort of know where this is going. You expand
976260	980860	that list of targets using a couple different methods. We're going to look at a couple different
980860	987240	ways to do this. You verify those targets, you discover more targets, and you do vitality scans
987240	991520	to see if they're up. That's sort of how the process works. Let's look at some interesting
991520	998360	ways to do this. First, locating targets. Some quick ways to locate targets. Lots of stuff in there.
998360	1002920	Your eyes are probably all drawn to the last one, which, yes, it does say scraping turds.
1004560	1008080	I don't know where the turds and the poo and all that stuff is coming from. It really is
1008080	1013020	not a statement about me personally, it's just how it came out. Okay, that was a bad way to say that.
1014660	1019620	All right, you get the idea. All right, very simple query, site colon microsoft.com. Again, we're
1019620	1025360	having a nice little conversation with Google, trying to do recon on microsoft.com. Site microsoft.com
1025360	1030540	lists every Google page from microsoft.com. All right, pretty straightforward. Problem is, the
1030540	1036100	results suck. If you're trying to acquire targets, the targets are rather limited. Top of the list is
1036100	1042640	www.microsoft.com, which the entire freaking planet knows exists. As an attacker, we don't care about
1042640	1049080	www.microsoft.com, so bottom line is, we want to get rid of it. So we change our query. Site
1049080	1057480	microsoft.com minus site screensaver.microsoft.com. Okay, and as you can see, when this query comes
1057480	1062800	back, we're not looking at www's anymore, we're getting interesting target names. So an attacker
1062800	1067980	sort of scrapes these target names to the side and, you know, collects them. Gets to be a little
1067980	1074400	bit tedious. This isn't a great way to do it, because you run into a query cap of 32 search
1074400	1079080	items in a query. So you keep reducing sites from this list, eventually you're going to run into
1079580	1085040	into a limit, but you're getting interesting results. Research.microsoft.com, partner.microsoft.com,
1085040	1091000	blah blah blah. All right, some other ways to do it. Back to regular expressions. Perform the query
1091000	1097580	in an automated fashion, slamming all the results of the html into a big file, and use regular
1097580	1103020	expressions to go through that file to look for urls that end in microsoft.com. Okay, so you're
1103020	1108180	still using google to do the actual query, but you're not necessarily limited by google's search
1108180	1114520	functionality. Okay, you can look for more interesting stuff. Okay, now you can not only do this with the
1114520	1119600	search result page itself, but you can do this with the entire html content of the website as
1119600	1126100	well, without throwing a single packet to the target. We'll talk about that next. All right, blah
1126100	1131440	blah blah. You run the thing, you get stuff. A big so what slide here. Yeah, I know there's other ways
1131440	1135740	to actually recon targets. The hook here is actually doing recon on the targets without
1135740	1140540	sending packets to it. So that's where we're going to go. Now that you've read all that, next slide.
1141560	1147160	All right, automated crawling. Google frowns on it. So we could use some other techniques to
1147160	1153900	actually get things done. I think I'm probably going to skip all of this because... blah blah.
1153900	1158460	I do want to highlight this. This is a nice tool again by SensePost. And you can download this
1158460	1163460	stuff. Biddyblah is a very powerful tool. I encourage you to go to SensePost's site and
1163460	1168020	check it out. But if you're not necessarily interested in all the functionality of Biddyblah,
1168020	1172880	but you're more interested in the techniques that Biddyblah uses to actually map out a network,
1172880	1177460	and you want to expand on that, some of these tools are available from SensePost as well.
1177460	1183740	Bottom line, run this Perl script with a domain name, comes back and gives you a list of subdomains,
1183740	1188280	DNS names and target names using Google queries. Pretty straightforward.
1189400	1196080	Okay. On to the turd thing. I came up with another term, Google turds, which Google hasn't
1196080	1202000	adopted yet either. I think it's because turds are usually brown and Google doesn't use brown
1202000	1207780	in any of their color schemes. Not to be too graphic about it. But a Google turd is a Google
1207780	1213600	query that's broken. It shouldn't return results. It's syntactically incorrect. Can anybody tell
1213600	1222020	me what's wrong with this query? Site colon NASA. There's no .gov. Right. It's a busted query.
1222020	1226480	Problem is, we got results. That's the heart and soul of a Google turd. Busted query that
1226480	1231860	gets results. These results could be interesting. We could do something with these results. Lots
1231860	1236940	of ways that these could have shown up. Syntax problems on the site when it was crawled, yada,
1236940	1243440	yada, yada. But we'll come back to this in a little bit. All right. Also, there's a lot
1243440	1248020	to be gotten from relationships between sites that you can actually use with Google. I'm going
1248020	1252360	to go really light on this, too. But the bottom line is, if you can scrape all of this stuff from
1252360	1258300	Google and get information about Microsoft.com, how much interest do you have in finding other
1258300	1262300	sites other than Microsoft.com that could potentially be targets that are owned by the
1262300	1268460	same entity? It's something you probably want to do. Well, in order to figure out relationships
1268460	1273160	between sites, we need to have somewhat of a process. For example, if I post a link on my
1273160	1278660	site to Microsoft.com, does that mean that there's a relationship between Microsoft and me?
1280020	1286460	No. Anybody can throw up a link to Microsoft.com. Now, let's ask it another way. If Microsoft also
1286460	1294200	has a link to me, is there possibly a relationship now? Possibly. In fact, it's fairly likely.
1294200	1299320	This is the heart and soul of link weighting. Weighing links to and from sites to determine
1299320	1304920	possible relationships. The bottom line here is that the two-way link weighs more than a
1304920	1308760	one-way link. And you can use all of this information when you're scraping all this
1308760	1316100	data from Google to figure out relationships. I just said that. Now, the question is,
1316100	1320360	what can we use to determine links to and from a target? The answer for everything in this talk is
1320360	1327760	Google, the link operator. Link www.microsoft.com shows all the sites that link to Microsoft's
1327760	1334680	website. The problem is the results. For example, MapQuest, second in the list. Microsoft have
1334680	1343320	anything to do with MapQuest? I hope not, do they? I don't know. Well, bottom line is the results are
1343320	1349020	pretty bad. Also, link doesn't play well with other operators, so link is very limited for
1349020	1356220	these purposes. If you try to use link and site together, the query is busted. It doesn't work.
1356880	1363780	So, blah, blah, blah. Again, SensePost to the rescue. They have all sorts of tools that do
1363780	1370820	stuff like this, and I'm really giving them a lot of press, because they deserve it. They've taken
1371060	1375780	a lot of these really cool ideas with Google, and they haven't done DEF CON and Black Hat talks on
1375780	1381940	them necessarily, but they've quietly implemented them into various tools that make sense. One of
1381940	1387360	the tools is Bile, the bi-directional link extractor. Basically, Bile automates the process
1387360	1394240	of figuring out link weights. Let me give you an example. For example, who is SensePost? You
1394240	1398820	guys probably know, but let's pretend we don't. A Google query doesn't give you much of an answer,
1398820	1406460	but if we throw SensePost.com into Bile, we find out that there are lots of links
1406460	1410720	to SensePost.com from lots of different servers, and here's where they are.
1411800	1416900	We also go through, and Bile will link weight each of those relationships to figure out which
1416900	1421480	is the strongest, and this is the output that you get. You'll notice SensePost.com is at the top.
1421480	1427500	It's the most strongly related site to SensePost that's out there. The second is BlackHat.com,
1427500	1433820	and these are sorted order. Then we've got PacketStorm Security, SecurityLab.ru. Bottom
1433820	1437700	line is, you can tell pretty quickly that SensePost has something to do with security,
1437700	1441960	and they're involved in the security community. It's all done with Google queries. Google queries
1441960	1447680	and link weighting. All right. Interesting question. Can Google be used to locate hosts
1447680	1456780	that Google doesn't even know about? Sort of a brain teaser. Sure. But we'll need to do some
1456780	1461840	background stuff first. Skipping that. All right. So we're at the point where we've located some
1461840	1465260	targets. We've seen some interesting ways to locate targets. How about expanding the target
1465260	1470480	list? Here's some ways that you can expand target lists. We'll talk about just a couple of them.
1471280	1475420	If you've got a list of hosts, if you've got a domain, foo.com, you could brute force the
1475420	1480540	domain with NSLookups. You could use every known word in a word list. You could do all
1480540	1485980	sorts of interrelationship stuff. But that stuff doesn't always work. You could do fuzzing. For
1485980	1493620	example, if I churn up BHST03.Verizon.com, I could fuzz that and see if BHST02 is there.
1493620	1499700	Same with something like www33. It's basic fuzzing to help us expand our host list.
1499840	1505820	Okay. You can also do it with names. Let's say we get these two hosts. Apple.foo.com and orange.foo.com.
1505820	1513060	Can anybody give me some other hosts that might exist? Mango is the first answer. Slick.
1514900	1521080	Caliente is not a fruit, is it? Passion fruit. You were at Black Hat, weren't you? That was the
1521080	1526120	number one answer was passion fruit. It's much more passionate than the ones I came up with,
1526120	1532040	but there you go. Cherry. I came up with mango. Watermelon. Pear. Strawberry. Banana. Didn't come
1532040	1537640	up with passion fruit. All right. So you've done some, you know, basic expansion, some really basic
1537640	1542140	fuzzing to figure out more targets that might be out there. All right. Let's figure out a more
1542140	1548860	interesting way to do it. Anybody here use Google Sets? Okay, good. Google Sets actually
1548860	1554220	takes a couple words, okay, that are related and tells you the next words in the series that might
1554220	1561020	appear using Google's database. So for example, apples and oranges fired into Google Sets gives
1561020	1567560	you a list that looks like this. We've got stuff like, we got here, we got pears and strawberries
1567560	1575660	and blueberries and figs and kiwis. It's a pretty good list. Okay. Could fairly easily
1575660	1581940	expand these, but let's try another exercise. We've got investor and foundation as host names.
1581940	1588680	Expand those. Okay, I'll cut to the chase because there's not a lot of answers coming.
1589000	1593700	It's tough. So let's throw it into Google Sets and see what Google Sets has to come up with.
1593700	1598500	Investor and foundation thrown into Google Sets gives us this awesome list of things like
1599110	1605220	the word board members and business directory and metal roof.
1607000	1614980	And owner occupied at what Foga Fopa. Man, you guys are dumb. You didn't come up with any of these.
1616280	1624340	Well, the problem is Google Sets did its best. The bottom line is here, we didn't give it related
1624340	1629720	terms. So the next question I pose to you is, armed with a list of words, we're thinking host
1629720	1634800	names here, right? How can we find the ones that are the most related? The answer for everything
1634800	1642640	in this talk is thank you. All right. Here's one way to do it. Take the host names, every host name
1642640	1647240	that you have, and split them up into unique pairs. For example, apple, pickle, orange, and
1647240	1652020	Fred are host names. Break them up into unique pairs. Apple, pickle, apple, orange, apple, Fred,
1652020	1658100	blah, blah, blah. And now we Google for each pair to get something that looks like this.
1658520	1664060	Okay. Based on the Google results, which of these somewhat related host names are the most
1664060	1672260	closely related? Apple and orange. It has the most hits. It's a reasonable assumption. So you
1672260	1677060	get a massive host list, feed it into unique pairs through Google queries, and get Google to tell
1677060	1681880	you which ones are the most closely related. And then you throw those two into Google sets, or you
1681880	1687000	automate this process, like we have on the bottom left, to get the same results. Bottom line, apple
1687000	1692660	and orange wins. Google figured out which of the words was most closely related. So let's pull it
1692660	1701780	together. I'll pull it together with pictures. All right. We get a list of targets. Here's sdsu.edu.
1701780	1710980	List of targets. Physics, music, bio, geology. Okay, they're college courses, right? So let's
1710980	1716240	feed, and this is automated here, let's feed all of these words into Google to come up with the two
1716240	1720560	that are the most closely related. And we find out that chemistry and physics are, in fact, the two
1720560	1726840	mostly closely related words. What we do next is feed chemistry and physics into Google sets to
1726840	1735460	get a list of expanded host names to figure out, and then stick them on to sdsu.edu. And what we're
1735460	1741320	gonna do is send a single NS lookup to figure out if these hosts resolve. Again, all automated. And
1741320	1747440	as you see, a lot of the hosts resolved. Okay, pretty nice. So we can also go in, we can do links
1747440	1751520	to see if they have, you know, if they're web servers, you can do port scanning, whatever. Now,
1751520	1756080	the only reason I'm checking to see if these are web servers is because of this very chic and
1756080	1763760	and very hard to read table. Now, the table is interesting, because it basically sums up what we
1763760	1770800	found. 13 new hosts that we didn't have before. Okay, we found 13 new hosts using this method,
1770800	1776400	seven of which Google knew nothing about. Google couldn't find any of these hosts.
1776840	1782020	Four of those hosts were web servers. So Google didn't even know about these web servers. So the
1782020	1785860	answer to the question is, can you use Google to find hosts that Google doesn't even know about
1785860	1795560	is yes. Thank you. All right. Blah, blah, blah. Verifying. I get a little bit into verifying.
1795580	1799340	Bottom line is you can use lots of stuff to verify the targets, but we're gonna try to do it
1799340	1805600	in a more stealthy fashion. One more example. Remember the NASA sites, all right? What was
1805600	1812920	missing from the end of them? .gov. 74 results in this Google turd query. If I slap .gov onto the
1812920	1819540	end of each of these hosts, how many of them do you think resolve? All of them. Okay, the bottom
1819540	1824220	line is these were posted to the web, they were broken, we fixed them, we resolved them, we found
1824220	1829160	targets. Okay, point is lots of ways to get interesting host information without sending
1829160	1835420	any packets to the target. All right. All right, now about zero packet scanning. This is sort of
1835420	1842560	meant as a joke. Zero packet scanning does not mean passive. Okay, I'm not talking about passive
1842560	1849040	here. I'm not talking, I'm talking about zero packets from you, the source, to your target. So
1849040	1853580	let's try to figure out some ways that we can actually do some recon without sending any packets
1853580	1859440	directly to the target. It's about having fun with Google, remember when security was fun? Okay, so
1859440	1867480	please no comments about the zero packet thing. All right. For example, DNS resolution isn't a big
1867480	1873400	deal. Okay, port scanning is, that flags IDS monitor, so we don't want to do that crap. So
1873400	1877600	let's find some interesting ways to get Google to help us out. Here you go, one Google query
1877600	1883440	that finds forms that look like this. This form lets you send an email to somebody from somebody
1883440	1888360	with a subject and a body and it comes from their web server. You do one Google query, you find this
1888360	1895140	form, you fire off email from them. Isn't this fun? One Google query, find sites that'll gladly
1895140	1900880	run the finger command for you. Notice I said that without opening myself to any finger jokes.
1902680	1906440	One Google query, find sites that will actually ping for you.
1907120	1911860	One Google query that will find sites that will gladly port scan a target for you.
1913080	1917020	Zero packets from you to the target. You proxy your connection through this site,
1917020	1923140	they're doing the port scanning, plus you're coming in proxy. Fun. How about this one? This
1923140	1926380	one's a little long-winded, so I'm going to blow through it. Another site that lets you do port
1926380	1934160	scanning, limited ports. See the limited ports? Here we go with more 1984 eliteness. What do you
1934160	1940720	think the colon 81 on the end of that URL refers to? A port. And what do you suppose that little
1940720	1949380	red dot that says port closed means? Port closed. So let's change the URL to 80 and we get a green
1949380	1955560	dot which means port open. So we write a little script that actually fires through all those URLs
1955560	1959760	to see which image is returned and we have an automated solution that actually bounces a port
1959760	1964620	scan off of another site, zero packets from you to the target, you get your port scan at their
1964620	1970060	expense. For example, you can even build an HTML page on your local workstation that looks like
1970060	1977640	this if you really must have green and red dots to break into a site. Some of you do and that's okay.
1979380	1984020	How about one Google query to find open proxy servers? Okay, when you run out of proxy servers
1984020	1989480	to bounce all this crap off of, fire off a Google query and find some more. Open reverse squid
1989480	1996700	proxies. Another CGI proxy, one query to find CGI proxies. Okay, this one's kind of fun. Please
1996700	2002880	choose URL slash encoding and then they give you a little box and you put a URL in there and what
2002880	2008360	do you know it bounces you to a site proxy style. Here I am viewing my website through a Chinese
2008360	2015460	government proxy. Oh, did I say Chinese? I meant I was thinking about Chinese food and it just came
2015460	2021780	out. Next slide, not the food, but the word. All right, here's one Google query that actually does
2021780	2026240	all this stuff for you. Sites that'll do all this crap. Trace route, who is, fingers, NS lookup,
2026240	2032520	hosts, DNS queries, digs. Again, one Google query, this site will do your bidding. Okay,
2032520	2038120	this one will find NQT. I covered NQT last year. It's got some interesting limited functionality.
2038360	2044540	But bottom line here is Jimmy Neutron actually turned this into a nice little Perl script to
2044540	2050380	bounce scans off of an NQT server so that you can do all this stuff off of NQT. These tools are
2050380	2055120	available from my website if you want to take a look at those. Okay, I'm skipping this one. This
2055120	2060540	is basically a Java SSH client. You can do all sorts of nasty stuff with this, but it's from
2060540	2067660	your machine. It's just kind of neat. So skip that. Oh, wait, come back. Is there a way to
2067660	2073200	anonymously web crawl a target without pounding it with packets? Of course. How many of you have
2073200	2079580	ever used a cache link? Keep your hands up. How many of you have ever read the banner at the top
2079580	2086880	of the cache page? Good. I got to say the average is better than it was at Black Hat. All right.
2086880	2091200	Now, for those of you that haven't read this page, shame on you, but let's figure out what happens
2091200	2096920	when you click on a cache link. All right, here's a TCP dump. We click on a cache link. We make a
2096920	2102520	connection to, in this case, the Frack website and to Google. Okay, so got some stuff going on.
2102520	2110120	Question is, what was that that happened behind the scenes? What is this? It's an image. Okay, so
2110120	2114300	up in the little header, Google was kind enough to tell you this cache page may reference images
2114300	2119680	which are no longer available. Click here for the cache text only. So let's click here for the
2119680	2125500	cache text only. Sniff it again. This time the entire conversation is between me and Google.
2125780	2131860	We got the HTML off the site safely from Google without touching the Frack website. Bottom line
2131860	2136880	here is it's very easy to get HTML content without sending any packets to the target.
2136880	2142100	What you do with that content is wide open. Run regular expressions through it. Do whatever you
2142100	2146160	want. Bottom line is you're not touching the target. You're talking to Google.
2147820	2153740	Question is, what happened behind the scenes? Top URL is the cache link. Bottom URL is the cache text
2153740	2159660	only. There's only one difference. It's got and strip equals one on the end. Okay, so let's see how
2159660	2165400	we would do this in the real world. Right click on a cache link. Save the address to the clipboard.
2165400	2170940	Paste it up to the address bar. Slap and strip equals one onto the end. And you're viewing the
2170940	2176480	HTML of the web page without sending any packets to the target. Easy, right? No, it's not. You're
2176480	2183460	supposed to say no, it's not. Okay, well, how about a Firefox plug-in that actually does this for you?
2185680	2191740	All right, right click on any URL on any page and you get these nifty little options.
2191740	2198100	Passive cache Google this link. What do you think that does? Okay, very nice plug-in written by
2198100	2205200	Brian Baskins available from our website. Not from Google. I'll say Google. All right, so you right
2205200	2209760	click on the link and it takes you to the passive cache Google image of that page. You don't have to
2209760	2215260	hit the target. The one under that is nice too. Passive cache archive this link. How about pulling
2215260	2220360	the page out of archive.org to see what it looked like in the past? Okay, so two very nice options
2220360	2226380	for getting web pages without touching the target. Right, Firefox. So yes, you can do zero packet
2226380	2231600	recon against the target. And we're flying, we're not letting you read, we're going on.
2233400	2237500	Yeah, I'll talk about this. This is kind of neat. I didn't necessarily invent this thing, but it's
2237500	2242900	it's kind of a neat situation. Let's say you go to a web page that you find in Google and it's down.
2242900	2247260	You click the cache link and sometimes the cache link's even broken. Sometimes you get that error
2247260	2253260	message. Well, the question is, is there any way we can recreate that web page without, you know,
2253260	2257940	without hurting ourselves? And the answer is cache sliding. Somebody else came up with this and
2257940	2262500	with all my Google skills I couldn't for the life of me figure out who it was. So if you know, please
2262500	2268120	tell me so you don't think I'm making this up as my own uber eliteness stuff. All right, so we have
2268120	2272580	this query. We can rebuild the web page just from the snippet. The way you do it is pretty
2272580	2278540	straightforward. What you do is you find the page that you're looking for, you narrow down the page
2278540	2284260	with a query, and you actually throw words from the snippet on the tail end of your query. Okay,
2284260	2289520	it's pretty straightforward. But what you do is you keep sliding your search queries forward so
2289520	2294120	that you can read more and more of the snippet. So for example, you can see I queried for natives
2294120	2301560	project next to each other, right? The next query I query for album entitled. Notice it's showing me
2301560	2308100	before and after my search term. I'm recreating the web page without the web page even being there.
2308100	2313060	The cache is gone. The real web page is gone. Bottom line is you keep sliding it forward and
2313060	2319500	forward until you recreate the entire web page. All right, neat stuff. Just a quick second about
2319500	2327080	this user agent spoofing. It's entirely possible for you to change your user agent to make your
2327080	2332420	browser look different. How many of you have ever changed your user agent to Googlebot? Excellent.
2332420	2338220	Nobody at Black Hat raised their hands. That's pretty cool. Well, surfing the net as Googlebot
2338220	2344120	has some interesting ramifications. For one, lots of badly configured sites like forums and news
2344120	2349700	sites actually lock people out depending on what their user agent is. For example, you got this
2349700	2354740	advertising on your site, right? You want Google to see your advertising and all that garbage and
2354740	2359800	be able to troll through your forum so that it can send visitors your way, all right? But you
2359800	2364520	want users to actually sign up for an account. So you block anybody that comes in that doesn't
2364520	2369380	have Googlebot as their user agent. So if you want to view the site, set your user agent to
2369380	2374180	Googlebot and you traipse right into the site as the Googlebot and get whatever you want.
2374280	2381380	Now, these people ain't too bright. I'll be the first to admit it. This is not security,
2381380	2387260	okay? I don't think it was meant to be. And a lot of sites do this cloaking a better way,
2387260	2391520	which is you look at the user agent plus you look at the IP they came from, see if it came from
2391520	2396920	Google. That's a better way to do it. But bottom line is you can have an awful lot of fun with this.
2397660	2404660	All right, the fireworks show. Welcome to the Google Hacking Showcase 2005.
2404840	2409420	All you people that are sleeping, wake up now. There you go.
2411080	2416600	Let the games begin, the best and worst of this year. All right, let's start pretty easy. How
2416600	2422600	about VNC servers? How many of you have used VNC or know what it is? Yeah. You install it on your
2422600	2427660	server, you install a client, you point it at your server, you control the keyboard and the mouse.
2427660	2431660	It's pretty nice. It requires a username, it requires a password, it requires you to know
2431660	2436940	the port that it's listening on. All right, how about one query that finds real VNC servers that
2436940	2442300	will actually send you down a Java-based client that you can use and is also nice enough to fill
2442300	2448960	in the hostname and the port that you should connect to, right? And one modification to the
2448960	2453800	query, and guess what? You can find sites that have no username or password associated with them.
2453860	2458380	One Google query, you're moving the keyboard and the mouse. Anybody that has doubts about it being
2458380	2465640	called Google Hacking, just go. All right, thank you. All right, this one's weak. Next, print
2465640	2473380	servers. Dang, got it. My laptop even thought it was weak. All right, one query that actually
2473380	2479380	finds access print servers. Now, print servers are boring little beasts, you know, unless you're
2479380	2486140	FX and those folks that do really ungodly things to printers. But printers get a really bad
2486140	2492780	rap. Now, I'm going to show you some more Oday here. This is really elite stuff. Press, you
2492780	2499780	should start writing right now. Five minutes? All right, let's fly. All right, the zero day here is
2499780	2506320	you actually click on that little oval right there with your thing that's a mouse, right? You click
2506320	2512300	the left button with your finger and you aim it at that little oval that says configuration wizard
2512300	2519440	and what do you think happens? It orders Chinese. No, not really. You enter configuration management.
2519440	2525420	How about webcams? I hate freaking webcams. These webcams, however, are really interesting. This
2525420	2531640	gives shoulder surfing a new name. This one's nice because it's pointing at big barrels of
2531640	2538420	explosive looking things and it has a laser button there. All right, so you can shoot the things.
2541160	2546380	I'm pretty sure that's what, I didn't click it, but all right. Anyway, this is the inside of a
2546380	2553020	tactical nuclear submarine. No, not really. But it's like eBay or something. I don't know.
2553020	2559940	Very interesting. How about this one? A speed stream DSL router. Very nice. Again, here we go
2559940	2564240	with the uber hacker tricks. Please do not print this in the press. What you do is you take the
2564240	2575730	mouse, left button again, and you click on that oval. It says disconnect. Yeah, what do you think
2575730	2581130	happens? Yeah, bye-bye. All right, how about this one? A Belkin router. One query finds Belkin
2581130	2585210	routers that are misconfigured. You can lock them out of their own wireless network for their own
2585210	2599620	safety. All right, how about this one? Who can guess the system password on this box?
2606210	2614490	Yeah, that's bad news. This is a query that finds a Windows small business server. Attention,
2614490	2619030	this site is for employee use. Only public access to our website can be found by clicking here. So
2619030	2625350	you're supposed to, you know, be there and not here. But anyway. All right. Boring. Next. Pivot
2625350	2630310	software. This one, this Google query lets you find pages that let you set up the administrator
2630310	2638230	user. And again, left button, little oval, proceed to log in, create an admin account. Got it.
2638410	2642970	Boring. Next. Printers. The printers suck unless you can see the print jobs that they're actually
2642970	2647230	printing. How about these? Microsoft Word documents. Some have to do with religion,
2647230	2655090	some have to do with aphrodisiacs. Problem was it was the same user. Not sure. This is like a
2655090	2659530	distributed denial of service. You find a printer that lets you do all this stuff to it. You turn
2659530	2669050	on NetWare and AppleTalk at the same time. It's just, it's just evil. One query to find
2669510	2675770	firewalls. How about smoothwall and IP cops that need updating? Snort IDS front ends. How many of
2675770	2682390	you know about that Cisco problem? Yeah, it's, there's a lot of technical stuff into how that
2682390	2686890	works. You can probably do something similar with a query like this to just find open Cisco
2686890	2695030	devices for people that are stupid. Open switches. Yep. PHP nuke is very nice. How about this one?
2695030	2700530	A query that finds PHP nuke sites. There are no administrator accounts yet. Proceed to create
2700530	2706990	them by clicking here. Yeah, for security reasons it is best that you create the super user right
2706990	2715760	now by clicking here. Parking lot Nazi cam. This is so you can see the CIO vault over his
2715760	2720240	convertible when he comes into the building from the handicapped parking spot. Okay, more security
2720240	2726680	cameras. Multiple camera views including one called Woody. I didn't click. I didn't click.
2727440	2732820	Time-lapse video recorders. That's not the end of my presentation. You guys knew I was out of time
2732820	2736900	so you went right to the end of my presentation. All right, we are very close to the end. Sorry
2736900	2750280	for the next person. Very sorry. Going back. We're going back. Okay, let's go to the...
2754870	2757550	Ah, here we go. Sorry, it will be worth the wait.
2757550	2764030	There we go. All right, I won't press the wrong button again. One query that lets you find...
2765330	2768710	I don't know what this is, but I think that stands for master bedroom.
2769730	2774190	How about this one? One query that lets you find e-power switches, web-controlled sockets
2774190	2778250	in somebody's house, electrical sockets, Google for the default password,
2778250	2781770	and you get these rectangular buttons, which it's sort of like crypto.
2784670	2788990	You click the rectangle in this case that says power and restart.
2790070	2795290	Yeah, all right. How about this one? Lots more things to turn off, including things like
2795830	2800910	on and off buttons. These are ovals, easy to find. Turn off lamps and motion detectors.
2801290	2806330	You can even turn off their media rack, their aquarium, and their electric bong.
2806890	2819950	How about this one? One click to turn off somebody's Christmas lights.
2820410	2826450	It's just rude. Usernames and passwords. How about digital camera image dumps from cell phones,
2826450	2833770	Sprint, T-Mobile, Counter-Strike server configs with clear text passwords, MSN contact lists,
2833770	2840430	how about vCalendar files, MSN ccMail mailbox files, open SQL servers, no username or password
2840430	2846810	required, point and click, own the database. SQLite, same deal. Netscape history files,
2846810	2853110	including clear text pop passwords. And the surfing list, which includes IBM and hotchicks.com.
2854470	2859970	How about this one? These are sysprep.in files that actually show the clear text admin password
2859970	2866430	and the product ID for Windows that they use to install it. All right, that's a good one. Yeah.
2866430	2874170	How about IPSec final encryption keys? VPN user profiles. Now, VPN is very secure,
2874170	2878390	so these are encrypted. Unfortunately, though, these are not.
2880050	2887210	How about Nessus scan output? Explorer windows, yes, that does say WinNT system 32. And yes,
2887210	2889670	the oval does read delete.
2896600	2900240	All right, police reports, sensitive government documents, yes,
2900240	2906720	sensitive government documents are on the web. How about this one for the FOUO raincoat?
2907100	2912980	The FOUO ensemble? The step-by-step instructions for putting on the coat,
2912980	2917500	which should be classified, I think. And whatever the hell this guy's doing.
2919260	2923140	I don't know what he's doing, but he's probably smiling, and that's rated a 10.
2923140	2930840	Yeah. Government research project, this is Boba Fett. The Silence of the Lambs guy.
2931740	2935640	Darth Vader with the drinking attachment.
2937040	2941540	If Darth Vader's at DEF CON, and he wants to drink, he shouldn't have to show his ugly head
2941540	2946280	now, should he? All right, so yeah, we got all sorts of stuff. How about this one? Authorized
2946280	2951920	user only. I'm at the end of the presentation again. Yes, it did say authorized user only.
2951920	2956080	Do not distribute, do not put on web. I am completely out of time, but let's do our last
2956080	2963720	two slides here. For a shirt, can anyone guess what this username and password should be to break
2963720	2972720	in here? All right. Very good. Next one. Next one's a little bit easier. How about...
2975040	2983100	how about... there we go. Sorry, I'm out of time, guys. All right. Yes. How do you break
2983100	2990060	into this site, folks? It says admin equals false in the URL. Yeah, let's change it to
2990060	2993560	admin equals true, and congratulations, you now have access.