[00:03.040 --> 00:08.680]  All right. Thanks for coming. My name is Johnny Long, in case you're in the wrong spot.
[00:10.580 --> 00:14.240]  Presentation today is called Google Hacking for Penetration Testers. How many of you have
[00:14.240 --> 00:18.580]  seen me speak before? Show of hands. Okay. How many of you have seen me speak on the
[00:18.580 --> 00:25.860]  topic of Google? Okay, cool. Thanks for coming and seeing me speak about Google again. Next
[00:25.860 --> 00:34.060]  year it'll be different. It'll be Yahoo. I have about an hour and a half talk here,
[00:34.620 --> 00:39.160]  which I'm told is just not possible. So I'm going to be flying through some stuff early
[00:39.160 --> 00:44.180]  on. The format of the talk is pretty straightforward. I go through some technical mumbo-jumbo in
[00:44.180 --> 00:48.400]  the beginning. It's a little bit dry, so for those of you that aren't technical, feel free
[00:48.400 --> 00:53.380]  to nap then. Because things get interesting towards the end and we have a nice firework
[00:53.380 --> 01:00.780]  show at the end. So those of you that nap, do it now. Also, after the talk, in the next
[01:00.780 --> 01:04.020]  room, just on the other side of this wall, we're going to do a book signing for the book
[01:04.020 --> 01:08.960]  by the same name written by some guy named Johnny that has gotten decent reviews and
[01:08.960 --> 01:13.700]  has lots of pretty pictures. So you might want to check that out. So I'll be doing a
[01:13.700 --> 01:18.280]  book sign across the wall. Also, we're going to be doing a contest. This worked out fairly
[01:18.280 --> 01:23.940]  well for Black Hat. I expect it to work out. Oh, cell phone rules. For every ring of a
[01:23.940 --> 01:29.440]  cell phone, it's $5 to a charity of my choice. That usually works. We're going to be doing
[01:29.440 --> 01:32.860]  a live Google hacking contest. For those of you that know a little bit about this topic
[01:32.860 --> 01:38.800]  and have come armed to actually win some prizes in the form of books from Syngress, I have
[01:38.800 --> 01:43.360]  two folks in the back that are helping me out. Hey Josh, Josh and Nick, can you put
[01:43.360 --> 01:48.360]  your hands up? Back here, against the wall. If you guys are interested in entering the
[01:48.360 --> 01:52.740]  Google hacking contest, here's what we're looking for. Interesting queries that are
[01:52.740 --> 01:58.700]  not already public, that cough up sensitive information, sort of a gentleman's agreement
[01:58.700 --> 02:03.560]  that they actually work and that they're actually unique. But here's the deal. To claim your
[02:03.560 --> 02:07.040]  prize, you need to come up in front of all these people and in front of that camera to
[02:07.040 --> 02:12.820]  claim your prize. We will have your email address and we'll inform all the other contestants
[02:12.820 --> 02:19.240]  of your cheating, lying ways. And we will give them your email address, so be warned.
[02:19.500 --> 02:22.960]  But anyway, seriously, if you guys have some interesting queries that you'd like to send
[02:22.960 --> 02:27.040]  to the guys in the back, we've got lots of prizes that we'd be happy to hook you up with.
[02:27.380 --> 02:33.120]  Alright, so let's dig in. This is the part that I'm going to go short on. How many of
[02:33.120 --> 02:42.260]  you have used Google? Show of hands. Everybody else has to leave, that's it. Alright, how
[02:42.260 --> 02:46.460]  many of you have used Google with advanced operators? Show of hands. Good, excellent.
[02:46.460 --> 02:51.000]  So I will go pretty light with this. Advanced operators are pretty straightforward. You
[02:51.000 --> 02:55.160]  basically put them right in with your query, just like your other search terms. The syntax
[02:55.160 --> 03:00.620]  is an operator followed by a colon followed by a thing. I'll call it a search term. There's
[03:00.620 --> 03:04.700]  no space before or after the colon. So let's get an idea of what some of the operators
[03:04.700 --> 03:10.680]  are. This is ripped right from a Singris book. It's the first time I ever enjoyed copyright
[03:10.680 --> 03:16.420]  infringement. It felt great. Anyway, you've got all the operators down the left-hand side,
[03:16.420 --> 03:20.780]  what the operator is, followed by the purpose of the operator, followed by a couple things
[03:20.780 --> 03:24.320]  that identify where the operator can be used and whether or not it plays nicely with the
[03:24.320 --> 03:27.880]  other operators. One of the things you'll realize when you start messing with this stuff
[03:27.880 --> 03:32.960]  is that some operators are just plain nasty. They just don't like to be messed around with.
[03:32.980 --> 03:38.020]  So this table sort of helps sort things out. But here's how... I'm going to skip this one
[03:38.020 --> 03:44.180]  because this is a bad demonstration. Here's how advanced operators can work. And by the
[03:44.180 --> 03:50.660]  way, I have 209 slides. Does anybody have more than that at DEF CON? Sweet. I have PowerPoint
[03:50.660 --> 03:56.620]  foo. Alright, we will get through them all. Alright, let's use advanced operators to actually
[03:56.620 --> 04:00.540]  find this page. This is a page from my website. And what I'm going to do is I'm actually going
[04:00.540 --> 04:09.960]  to define this page with advanced operators. That's true. My PowerPoint foo skills are
[04:09.960 --> 04:17.420]  gone now. You will be able to get this off my website after the conference. I felt very
[04:17.420 --> 04:22.960]  uncomfortable pushing the 40 megs worth of Google joy up on my server with all of you
[04:22.960 --> 04:28.720]  evil people around. After the con, you guys can pick it up. I have yo-yo skills, though.
[04:32.990 --> 04:37.730]  So let's define this page. Here you go. In title, I hack stuff. Notice we're using a
[04:37.730 --> 04:41.710]  phrase. We're looking for a phrase in the title. I'm building a Google query here to
[04:41.710 --> 04:50.130]  define the page. File type, PHP. This is a PHP page. Num range. Num range got a lot of
[04:50.130 --> 04:55.570]  press last year through no fault of my own. And I still won't describe the evil uses of
[04:55.570 --> 05:01.270]  num range, but if you haven't figured it out by now, all hope is lost for you. But num
[05:01.270 --> 05:07.550]  range is absolutely evil. I know you. I think you're going to need to come up here and drink
[05:07.550 --> 05:20.710]  that if you're bringing it up. Yeah. Come on. Who wants Mudge to sit up here? Okay.
[05:21.630 --> 05:31.760]  What are you going to do with my DNA? I've already got it elsewhere. None of you heard
[05:31.760 --> 05:38.700]  that. All right. On with the show. Let's go a little bit farther in text. Navigate in
[05:38.700 --> 05:43.020]  text is a little bit goofy because in text sort of does what you think Google searching
[05:43.020 --> 05:47.100]  normally does. It finds stuff in the text of a web page. But the bottom line here is
[05:47.100 --> 05:51.940]  you throw all of this crap together into one big nasty query and you get something that
[05:51.940 --> 05:56.080]  looks like this. One result. You've basically used advanced operators to narrow down your
[05:56.080 --> 06:03.880]  search very efficiently. So there we go. One hit. That's advanced Google searching. I've
[06:03.880 --> 06:08.460]  gotten a lot of flack about the term Google hacking. So let's show where the line is.
[06:08.840 --> 06:15.020]  Google hacking basically is looking for pages that look something like this. Can anybody
[06:15.020 --> 06:27.720]  tell me what this URL might describe? Thank you. Thank you. Thanks so much. Okay. I'm
[06:27.720 --> 06:34.400]  here in e-commerce, right? Shopping cart. Yeah. I hear credit cards. There you go. Yeah.
[06:34.400 --> 06:37.980]  This is basically... well, we'll show you what it describes, but here's the query. In
[06:37.980 --> 06:43.880]  URL admin, in URL orders, file type PHP. It's a nice query. Throw it into Google. You find
[06:43.880 --> 06:47.840]  pages that look like this. It's the back end of an e-commerce site. It's the administrative
[06:48.160 --> 06:52.040]  page for an e-commerce site. So you've got customer orders. You've got order amounts.
[06:52.040 --> 06:55.760]  You've got ship dates. Okay. And then on the bottom right, you can see we've got payment
[06:55.760 --> 07:00.380]  details including bank information, credit card information. Okay. This is the heart
[07:00.380 --> 07:04.180]  and soul of Google hacking. It's basically using Google, first of all, to do things that
[07:04.180 --> 07:07.940]  it wasn't necessarily designed to do, and secondly, find things that aren't necessarily
[07:07.940 --> 07:15.880]  public. All right. Now, I came up with this interesting term called Google dork, which
[07:15.880 --> 07:22.120]  by my own definition is a foolish or inept person as revealed by Google. All right. So
[07:22.120 --> 07:26.560]  the term Google dork has gotten pretty popular despite the fact that Google has not put it
[07:26.560 --> 07:33.320]  on their web page anywhere. But it's become obvious lately that Google has started blocking
[07:33.320 --> 07:39.320]  queries. Okay. And I call the blocking of malicious queries the GDDS for the Google
[07:39.320 --> 07:46.840]  dork detection system. This is just a blurb. I'm going to fly past this. This is basically
[07:46.840 --> 07:51.540]  legalese so that the white hats in the community don't yell at me for, you know, revealing
[07:51.540 --> 07:57.520]  this thing. Bottom line is, Google's blocking queries. They've never before stepped into
[07:57.520 --> 08:01.980]  this game of messing with your queries. Okay. They've been in the ivory, I don't want to
[08:01.980 --> 08:05.560]  say ivory tower, it's got negative connotations, but they've never jumped into the security
[08:05.560 --> 08:11.160]  game before until now. Well, the problem that I have with that is that they're not doing
[08:11.160 --> 08:15.420]  it very well. Let's take a look at why. Anybody run into a page like this when they're doing
[08:15.540 --> 08:21.760]  a Google query? Show of hands. Anyone? You all are evil. Everyone look around. People
[08:21.760 --> 08:29.760]  with their hands up are evil. Okay? This screen comes up when you try a malicious query and
[08:29.760 --> 08:33.080]  Google just doesn't like it. So what we're going to do is we're going to actually try
[08:33.080 --> 08:39.520]  to bypass this screen. So this was for inurladmin.php. This is what the query looks like in the form
[08:39.520 --> 08:43.480]  of a URL up at the top. Down the middle, for those of you in the back that can't see, I've
[08:43.480 --> 08:50.580]  basically highlighted the query part. It says inurl colon admin dot php. Well, here's uber
[08:50.580 --> 08:58.260]  hacker trick oday of the talk number one. Okay? I've got lots of them. Unfortunately,
[08:58.260 --> 09:04.480]  this is like oday from like 84. All right. So our first bypass technique involves just
[09:04.480 --> 09:11.740]  changing the case of any of the words in the query. So how about admin dot capital php?
[09:12.840 --> 09:18.260]  So what do you think happens when we fire off any of these queries? Lo and behold, it
[09:18.260 --> 09:23.020]  goes through. Okay? Now, I'm not going to pick on Google too much for this one because
[09:23.020 --> 09:28.780]  about two days after I talked about this in Japan for Black Hat, magically this got
[09:28.780 --> 09:33.700]  fixed. Which was cool. I counted that as a personal victory. I was like, all right, well,
[09:33.700 --> 09:40.880]  let's keep going. So that was round one. Let's talk about round two. Round two is query shifting.
[09:40.880 --> 09:47.780]  Here's an interesting query. This one is for a index dot php file that has php bb2 somewhere
[09:47.780 --> 09:53.960]  in the URL. And they block it. Malicious query. So call this query shifting. Basically what I'm
[09:53.960 --> 09:58.480]  going to do is I'm going to use the same query for all intents and purposes, but I'm going to
[09:58.480 --> 10:05.420]  use different operators. So I'm going to look for php bb2 in the URL still, a file type of php
[10:05.420 --> 10:11.060]  and the word index. It's essentially the same query and it goes through. Shift around Google's
[10:11.060 --> 10:16.960]  operators, make the search a little bit different, it goes through. Query shifting. This one's my
[10:16.960 --> 10:22.420]  personal favorite. Some of these are getting fixed, like as we speak, some of them are still
[10:22.420 --> 10:31.440]  lingering, so your mileage may vary. But anyway, powered by php bb gets blocked. Now, this is a
[10:31.440 --> 10:43.180]  leap. Just wait for it. Check out what you do to get the query to go through.
[10:43.180 --> 10:48.360]  Okay. Putting spaces between the letters and the word powered lets the query go through.
[10:48.360 --> 10:52.880]  Now, you would think that this would just not work. Google would take one look at this and go,
[10:52.880 --> 10:58.260]  you're a frigging idiot. Well, they do it nicely and it would be in pleasing colors that weren't
[10:58.260 --> 11:04.040]  offensive. But, you know, normally they'd like fix it for you. Well, Google does actually fix
[11:04.040 --> 11:08.380]  this query for you. They take one look at it and they're like, what you meant to say was powered,
[11:08.380 --> 11:12.760]  but hold on, let me check the query to see if it's evil. Not evil. Okay, I'm going to fix it
[11:12.760 --> 11:17.840]  so that I'm searching for what you're looking for and I'm going to search for powered by php bb.
[11:17.840 --> 11:22.080]  You can tell it's searching for that because down in the actual query results, it highlights the
[11:22.080 --> 11:30.720]  words powered by php bb. I'm telling you, oday from 84. All right. Here's another example,
[11:30.720 --> 11:35.640]  same thing, powered by php bb2, blah, blah, blah, throw some spaces in there. It also works if you
[11:35.640 --> 11:42.560]  throw pluses between the letters in the URL. That's also elite. How many of you have seen this
[11:42.560 --> 11:50.660]  message? Show of hands. Okay. Those 10 people are really evil. All right. This is the message
[11:50.660 --> 11:55.740]  that you get when you violate Google's terms of service. That you've all read.
[11:58.540 --> 12:02.300]  You're laughing at me. I saw a lot of hands. I saw a lot of people in the audience say,
[12:02.300 --> 12:07.400]  yeah, you're Google users. So how many of you Google users have read the terms of service?
[12:08.320 --> 12:14.060]  That's what I thought. Yeah. All right. Well, Google's terms of service says don't do
[12:14.060 --> 12:18.220]  automation. That's the long and short of it. They give you some alternatives. The alternatives sort
[12:18.220 --> 12:23.560]  of suck. But they say don't do automation. I got this message by actually curling for a Google
[12:23.560 --> 12:29.640]  query. I used curl. There's my query. Fired it into poo.html, which doesn't mean anything,
[12:29.640 --> 12:35.020]  by the way. And I viewed the page. And we get this forbidden message. Now, can anybody tell me
[12:35.020 --> 12:39.580]  exactly what's different between curl and any other web browser that Google might be interested
[12:39.580 --> 12:47.480]  in? Thank you. Oday. Here we go. How about if you throw a user agent into curl and actually try it
[12:47.480 --> 12:53.860]  again, what do you think happens? Yeah. Throw a user agent in there. Now, I threw a really nice
[12:53.860 --> 12:57.320]  user agent in there. I did a little bit of research. Got out my sniffer. I was feeling all
[12:57.320 --> 13:02.520]  Uber. I'm like, ooh, look at the nice user agent for my browser. Copied into curl. I'm like, yeah,
[13:02.520 --> 13:08.620]  I'm the man. And then I started thinking, you know, I really can't type as well as I used to.
[13:08.620 --> 13:12.860]  And I actually looked at my curl command line. I had this typo in there. I actually had a F space
[13:12.860 --> 13:19.180]  Firefox as my web browser. And then I thought to myself, I wonder what happens if I just throw,
[13:19.180 --> 13:24.100]  you know, like poo in there as the user agent. What would happen? Take a guess what happens.
[13:24.520 --> 13:28.660]  It works. All right. So, Google's looking at the user agent, but they don't give a fly and flip
[13:28.660 --> 13:32.740]  exactly what you put in there. It just has to be in there somewhere, which makes sense. They don't
[13:32.740 --> 13:36.720]  want to block the newest browsers from getting search results. So, anyway, that's how you get
[13:36.720 --> 13:41.580]  past some automation. All right. Question is, why do this? Bottom line is, Google's not going to
[13:41.580 --> 13:47.180]  protect you from evil searches. You got to take the battle into your own hands. All right. Let's
[13:47.180 --> 13:52.220]  keep moving. I'm going to fly through this, because this is pretty basic stuff. And it was
[13:52.220 --> 13:58.240]  fluff for the people at Black Hat, because they're not as smart as you guys. Just kidding. All right.
[13:58.240 --> 14:02.000]  Bottom line is, there's some interesting things you can do if Google queries just don't work out
[14:02.000 --> 14:06.360]  for you. This is an example of a query looking for email addresses. We're some spam troll, and
[14:06.360 --> 14:11.000]  we're out there looking for email addresses. So, we look for at gmail.com. Well, Google throws away
[14:11.000 --> 14:15.720]  the at sign. Okay. The bottom line is, there's lots of data out there in Google that can be
[14:15.720 --> 14:21.080]  mined very effectively for all sorts of different things, and can be mined in such a way as to not
[14:21.080 --> 14:25.660]  send any packets to the target that you're trying to get more information about. We'll talk about
[14:25.660 --> 14:31.200]  anonymity in a minute. Bottom line is, if Google queries don't work for you, and yeah, this is
[14:31.200 --> 14:38.420]  really elite, too, you know, using a regular expression on an HTML file dump of a query page
[14:38.940 --> 14:43.640]  gets you the same result. For example, I use links to actually do the same query, pull the results
[14:43.640 --> 14:48.740]  down, and then I look in that file for gmail addresses using a regular expression. Okay.
[14:48.740 --> 14:53.560]  Pretty straightforward. But the bottom line is, this is a little bit, you know, it's a little bit
[14:54.080 --> 14:58.820]  hard doing it this way, you know, with links, but if you search more and more pages, you can actually
[14:58.820 --> 15:04.540]  get more results. Actually, this one was done with a program called Email Miner from
[15:04.540 --> 15:11.040]  SensePost. How many saw the SensePost talk today? Okay. SensePost has a really cool tool called
[15:11.040 --> 15:14.940]  BidiBlah, which they released today, and they do a lot of things to actually do open source
[15:14.940 --> 15:19.120]  information gathering about targets using Google. Basically, what I'm doing here is, I'm showing you
[15:19.120 --> 15:25.240]  some of what they do behind the scenes. You know, there's nothing terribly technical about it,
[15:25.240 --> 15:30.940]  but it's an interesting way to actually profile a target. So, lots of email addresses, we troll
[15:30.940 --> 15:35.780]  through more results, we get more hits. I threw this in there because it's just funny, and I like
[15:35.780 --> 15:41.940]  ripping stuff out of people's books. Other places to find email addresses, how about Excel spreadsheets
[15:41.940 --> 15:50.760]  called email.xls? Yeah, I like that one. How about Outlook address books? Yeah, you name it, it's in
[15:50.760 --> 15:56.420]  there. How about registry files that actually have internet account management? Pop three
[15:56.420 --> 16:01.420]  passwords in there. All sorts of places. Well, the same thing can actually be done to map
[16:01.540 --> 16:06.440]  a network, and this gets a little deeper, but the process of actually mapping out a network
[16:06.440 --> 16:11.720]  might look something like this. You get a list of targets, you find related targets, perhaps
[16:11.720 --> 16:16.260]  outside that domain. Those of you that saw SensePost talk sort of know where this is going. You expand
[16:16.260 --> 16:20.860]  that list of targets using a couple different methods. We're going to look at a couple different
[16:20.860 --> 16:27.240]  ways to do this. You verify those targets, you discover more targets, and you do vitality scans
[16:27.240 --> 16:31.520]  to see if they're up. That's sort of how the process works. Let's look at some interesting
[16:31.520 --> 16:38.360]  ways to do this. First, locating targets. Some quick ways to locate targets. Lots of stuff in there.
[16:38.360 --> 16:42.920]  Your eyes are probably all drawn to the last one, which, yes, it does say scraping turds.
[16:44.560 --> 16:48.080]  I don't know where the turds and the poo and all that stuff is coming from. It really is
[16:48.080 --> 16:53.020]  not a statement about me personally, it's just how it came out. Okay, that was a bad way to say that.
[16:54.660 --> 16:59.620]  All right, you get the idea. All right, very simple query, site colon microsoft.com. Again, we're
[16:59.620 --> 17:05.360]  having a nice little conversation with Google, trying to do recon on microsoft.com. Site microsoft.com
[17:05.360 --> 17:10.540]  lists every Google page from microsoft.com. All right, pretty straightforward. Problem is, the
[17:10.540 --> 17:16.100]  results suck. If you're trying to acquire targets, the targets are rather limited. Top of the list is
[17:16.100 --> 17:22.640]  www.microsoft.com, which the entire freaking planet knows exists. As an attacker, we don't care about
[17:22.640 --> 17:29.080]  www.microsoft.com, so bottom line is, we want to get rid of it. So we change our query. Site
[17:29.080 --> 17:37.480]  microsoft.com minus site screensaver.microsoft.com. Okay, and as you can see, when this query comes
[17:37.480 --> 17:42.800]  back, we're not looking at www's anymore, we're getting interesting target names. So an attacker
[17:42.800 --> 17:47.980]  sort of scrapes these target names to the side and, you know, collects them. Gets to be a little
[17:47.980 --> 17:54.400]  bit tedious. This isn't a great way to do it, because you run into a query cap of 32 search
[17:54.400 --> 17:59.080]  items in a query. So you keep reducing sites from this list, eventually you're going to run into
[17:59.580 --> 18:05.040]  into a limit, but you're getting interesting results. Research.microsoft.com, partner.microsoft.com,
[18:05.040 --> 18:11.000]  blah blah blah. All right, some other ways to do it. Back to regular expressions. Perform the query
[18:11.000 --> 18:17.580]  in an automated fashion, slamming all the results of the html into a big file, and use regular
[18:17.580 --> 18:23.020]  expressions to go through that file to look for urls that end in microsoft.com. Okay, so you're
[18:23.020 --> 18:28.180]  still using google to do the actual query, but you're not necessarily limited by google's search
[18:28.180 --> 18:34.520]  functionality. Okay, you can look for more interesting stuff. Okay, now you can not only do this with the
[18:34.520 --> 18:39.600]  search result page itself, but you can do this with the entire html content of the website as
[18:39.600 --> 18:46.100]  well, without throwing a single packet to the target. We'll talk about that next. All right, blah
[18:46.100 --> 18:51.440]  blah blah. You run the thing, you get stuff. A big so what slide here. Yeah, I know there's other ways
[18:51.440 --> 18:55.740]  to actually recon targets. The hook here is actually doing recon on the targets without
[18:55.740 --> 19:00.540]  sending packets to it. So that's where we're going to go. Now that you've read all that, next slide.
[19:01.560 --> 19:07.160]  All right, automated crawling. Google frowns on it. So we could use some other techniques to
[19:07.160 --> 19:13.900]  actually get things done. I think I'm probably going to skip all of this because... blah blah.
[19:13.900 --> 19:18.460]  I do want to highlight this. This is a nice tool again by SensePost. And you can download this
[19:18.460 --> 19:23.460]  stuff. Biddyblah is a very powerful tool. I encourage you to go to SensePost's site and
[19:23.460 --> 19:28.020]  check it out. But if you're not necessarily interested in all the functionality of Biddyblah,
[19:28.020 --> 19:32.880]  but you're more interested in the techniques that Biddyblah uses to actually map out a network,
[19:32.880 --> 19:37.460]  and you want to expand on that, some of these tools are available from SensePost as well.
[19:37.460 --> 19:43.740]  Bottom line, run this Perl script with a domain name, comes back and gives you a list of subdomains,
[19:43.740 --> 19:48.280]  DNS names and target names using Google queries. Pretty straightforward.
[19:49.400 --> 19:56.080]  Okay. On to the turd thing. I came up with another term, Google turds, which Google hasn't
[19:56.080 --> 20:02.000]  adopted yet either. I think it's because turds are usually brown and Google doesn't use brown
[20:02.000 --> 20:07.780]  in any of their color schemes. Not to be too graphic about it. But a Google turd is a Google
[20:07.780 --> 20:13.600]  query that's broken. It shouldn't return results. It's syntactically incorrect. Can anybody tell
[20:13.600 --> 20:22.020]  me what's wrong with this query? Site colon NASA. There's no .gov. Right. It's a busted query.
[20:22.020 --> 20:26.480]  Problem is, we got results. That's the heart and soul of a Google turd. Busted query that
[20:26.480 --> 20:31.860]  gets results. These results could be interesting. We could do something with these results. Lots
[20:31.860 --> 20:36.940]  of ways that these could have shown up. Syntax problems on the site when it was crawled, yada,
[20:36.940 --> 20:43.440]  yada, yada. But we'll come back to this in a little bit. All right. Also, there's a lot
[20:43.440 --> 20:48.020]  to be gotten from relationships between sites that you can actually use with Google. I'm going
[20:48.020 --> 20:52.360]  to go really light on this, too. But the bottom line is, if you can scrape all of this stuff from
[20:52.360 --> 20:58.300]  Google and get information about Microsoft.com, how much interest do you have in finding other
[20:58.300 --> 21:02.300]  sites other than Microsoft.com that could potentially be targets that are owned by the
[21:02.300 --> 21:08.460]  same entity? It's something you probably want to do. Well, in order to figure out relationships
[21:08.460 --> 21:13.160]  between sites, we need to have somewhat of a process. For example, if I post a link on my
[21:13.160 --> 21:18.660]  site to Microsoft.com, does that mean that there's a relationship between Microsoft and me?
[21:20.020 --> 21:26.460]  No. Anybody can throw up a link to Microsoft.com. Now, let's ask it another way. If Microsoft also
[21:26.460 --> 21:34.200]  has a link to me, is there possibly a relationship now? Possibly. In fact, it's fairly likely.
[21:34.200 --> 21:39.320]  This is the heart and soul of link weighting. Weighing links to and from sites to determine
[21:39.320 --> 21:44.920]  possible relationships. The bottom line here is that the two-way link weighs more than a
[21:44.920 --> 21:48.760]  one-way link. And you can use all of this information when you're scraping all this
[21:48.760 --> 21:56.100]  data from Google to figure out relationships. I just said that. Now, the question is,
[21:56.100 --> 22:00.360]  what can we use to determine links to and from a target? The answer for everything in this talk is
[22:00.360 --> 22:07.760]  Google, the link operator. Link www.microsoft.com shows all the sites that link to Microsoft's
[22:07.760 --> 22:14.680]  website. The problem is the results. For example, MapQuest, second in the list. Microsoft have
[22:14.680 --> 22:23.320]  anything to do with MapQuest? I hope not, do they? I don't know. Well, bottom line is the results are
[22:23.320 --> 22:29.020]  pretty bad. Also, link doesn't play well with other operators, so link is very limited for
[22:29.020 --> 22:36.220]  these purposes. If you try to use link and site together, the query is busted. It doesn't work.
[22:36.880 --> 22:43.780]  So, blah, blah, blah. Again, SensePost to the rescue. They have all sorts of tools that do
[22:43.780 --> 22:50.820]  stuff like this, and I'm really giving them a lot of press, because they deserve it. They've taken
[22:51.060 --> 22:55.780]  a lot of these really cool ideas with Google, and they haven't done DEF CON and Black Hat talks on
[22:55.780 --> 23:01.940]  them necessarily, but they've quietly implemented them into various tools that make sense. One of
[23:01.940 --> 23:07.360]  the tools is Bile, the bi-directional link extractor. Basically, Bile automates the process
[23:07.360 --> 23:14.240]  of figuring out link weights. Let me give you an example. For example, who is SensePost? You
[23:14.240 --> 23:18.820]  guys probably know, but let's pretend we don't. A Google query doesn't give you much of an answer,
[23:18.820 --> 23:26.460]  but if we throw SensePost.com into Bile, we find out that there are lots of links
[23:26.460 --> 23:30.720]  to SensePost.com from lots of different servers, and here's where they are.
[23:31.800 --> 23:36.900]  We also go through, and Bile will link weight each of those relationships to figure out which
[23:36.900 --> 23:41.480]  is the strongest, and this is the output that you get. You'll notice SensePost.com is at the top.
[23:41.480 --> 23:47.500]  It's the most strongly related site to SensePost that's out there. The second is BlackHat.com,
[23:47.500 --> 23:53.820]  and these are sorted order. Then we've got PacketStorm Security, SecurityLab.ru. Bottom
[23:53.820 --> 23:57.700]  line is, you can tell pretty quickly that SensePost has something to do with security,
[23:57.700 --> 24:01.960]  and they're involved in the security community. It's all done with Google queries. Google queries
[24:01.960 --> 24:07.680]  and link weighting. All right. Interesting question. Can Google be used to locate hosts
[24:07.680 --> 24:16.780]  that Google doesn't even know about? Sort of a brain teaser. Sure. But we'll need to do some
[24:16.780 --> 24:21.840]  background stuff first. Skipping that. All right. So we're at the point where we've located some
[24:21.840 --> 24:25.260]  targets. We've seen some interesting ways to locate targets. How about expanding the target
[24:25.260 --> 24:30.480]  list? Here's some ways that you can expand target lists. We'll talk about just a couple of them.
[24:31.280 --> 24:35.420]  If you've got a list of hosts, if you've got a domain, foo.com, you could brute force the
[24:35.420 --> 24:40.540]  domain with NSLookups. You could use every known word in a word list. You could do all
[24:40.540 --> 24:45.980]  sorts of interrelationship stuff. But that stuff doesn't always work. You could do fuzzing. For
[24:45.980 --> 24:53.620]  example, if I churn up BHST03.Verizon.com, I could fuzz that and see if BHST02 is there.
[24:53.620 --> 24:59.700]  Same with something like www33. It's basic fuzzing to help us expand our host list.
[24:59.840 --> 25:05.820]  Okay. You can also do it with names. Let's say we get these two hosts. Apple.foo.com and orange.foo.com.
[25:05.820 --> 25:13.060]  Can anybody give me some other hosts that might exist? Mango is the first answer. Slick.
[25:14.900 --> 25:21.080]  Caliente is not a fruit, is it? Passion fruit. You were at Black Hat, weren't you? That was the
[25:21.080 --> 25:26.120]  number one answer was passion fruit. It's much more passionate than the ones I came up with,
[25:26.120 --> 25:32.040]  but there you go. Cherry. I came up with mango. Watermelon. Pear. Strawberry. Banana. Didn't come
[25:32.040 --> 25:37.640]  up with passion fruit. All right. So you've done some, you know, basic expansion, some really basic
[25:37.640 --> 25:42.140]  fuzzing to figure out more targets that might be out there. All right. Let's figure out a more
[25:42.140 --> 25:48.860]  interesting way to do it. Anybody here use Google Sets? Okay, good. Google Sets actually
[25:48.860 --> 25:54.220]  takes a couple words, okay, that are related and tells you the next words in the series that might
[25:54.220 --> 26:01.020]  appear using Google's database. So for example, apples and oranges fired into Google Sets gives
[26:01.020 --> 26:07.560]  you a list that looks like this. We've got stuff like, we got here, we got pears and strawberries
[26:07.560 --> 26:15.660]  and blueberries and figs and kiwis. It's a pretty good list. Okay. Could fairly easily
[26:15.660 --> 26:21.940]  expand these, but let's try another exercise. We've got investor and foundation as host names.
[26:21.940 --> 26:28.680]  Expand those. Okay, I'll cut to the chase because there's not a lot of answers coming.
[26:29.000 --> 26:33.700]  It's tough. So let's throw it into Google Sets and see what Google Sets has to come up with.
[26:33.700 --> 26:38.500]  Investor and foundation thrown into Google Sets gives us this awesome list of things like
[26:39.110 --> 26:45.220]  the word board members and business directory and metal roof.
[26:47.000 --> 26:54.980]  And owner occupied at what Foga Fopa. Man, you guys are dumb. You didn't come up with any of these.
[26:56.280 --> 27:04.340]  Well, the problem is Google Sets did its best. The bottom line is here, we didn't give it related
[27:04.340 --> 27:09.720]  terms. So the next question I pose to you is, armed with a list of words, we're thinking host
[27:09.720 --> 27:14.800]  names here, right? How can we find the ones that are the most related? The answer for everything
[27:14.800 --> 27:22.640]  in this talk is thank you. All right. Here's one way to do it. Take the host names, every host name
[27:22.640 --> 27:27.240]  that you have, and split them up into unique pairs. For example, apple, pickle, orange, and
[27:27.240 --> 27:32.020]  Fred are host names. Break them up into unique pairs. Apple, pickle, apple, orange, apple, Fred,
[27:32.020 --> 27:38.100]  blah, blah, blah. And now we Google for each pair to get something that looks like this.
[27:38.520 --> 27:44.060]  Okay. Based on the Google results, which of these somewhat related host names are the most
[27:44.060 --> 27:52.260]  closely related? Apple and orange. It has the most hits. It's a reasonable assumption. So you
[27:52.260 --> 27:57.060]  get a massive host list, feed it into unique pairs through Google queries, and get Google to tell
[27:57.060 --> 28:01.880]  you which ones are the most closely related. And then you throw those two into Google sets, or you
[28:01.880 --> 28:07.000]  automate this process, like we have on the bottom left, to get the same results. Bottom line, apple
[28:07.000 --> 28:12.660]  and orange wins. Google figured out which of the words was most closely related. So let's pull it
[28:12.660 --> 28:21.780]  together. I'll pull it together with pictures. All right. We get a list of targets. Here's sdsu.edu.
[28:21.780 --> 28:30.980]  List of targets. Physics, music, bio, geology. Okay, they're college courses, right? So let's
[28:30.980 --> 28:36.240]  feed, and this is automated here, let's feed all of these words into Google to come up with the two
[28:36.240 --> 28:40.560]  that are the most closely related. And we find out that chemistry and physics are, in fact, the two
[28:40.560 --> 28:46.840]  mostly closely related words. What we do next is feed chemistry and physics into Google sets to
[28:46.840 --> 28:55.460]  get a list of expanded host names to figure out, and then stick them on to sdsu.edu. And what we're
[28:55.460 --> 29:01.320]  gonna do is send a single NS lookup to figure out if these hosts resolve. Again, all automated. And
[29:01.320 --> 29:07.440]  as you see, a lot of the hosts resolved. Okay, pretty nice. So we can also go in, we can do links
[29:07.440 --> 29:11.520]  to see if they have, you know, if they're web servers, you can do port scanning, whatever. Now,
[29:11.520 --> 29:16.080]  the only reason I'm checking to see if these are web servers is because of this very chic and
[29:16.080 --> 29:23.760]  and very hard to read table. Now, the table is interesting, because it basically sums up what we
[29:23.760 --> 29:30.800]  found. 13 new hosts that we didn't have before. Okay, we found 13 new hosts using this method,
[29:30.800 --> 29:36.400]  seven of which Google knew nothing about. Google couldn't find any of these hosts.
[29:36.840 --> 29:42.020]  Four of those hosts were web servers. So Google didn't even know about these web servers. So the
[29:42.020 --> 29:45.860]  answer to the question is, can you use Google to find hosts that Google doesn't even know about
[29:45.860 --> 29:55.560]  is yes. Thank you. All right. Blah, blah, blah. Verifying. I get a little bit into verifying.
[29:55.580 --> 29:59.340]  Bottom line is you can use lots of stuff to verify the targets, but we're gonna try to do it
[29:59.340 --> 30:05.600]  in a more stealthy fashion. One more example. Remember the NASA sites, all right? What was
[30:05.600 --> 30:12.920]  missing from the end of them? .gov. 74 results in this Google turd query. If I slap .gov onto the
[30:12.920 --> 30:19.540]  end of each of these hosts, how many of them do you think resolve? All of them. Okay, the bottom
[30:19.540 --> 30:24.220]  line is these were posted to the web, they were broken, we fixed them, we resolved them, we found
[30:24.220 --> 30:29.160]  targets. Okay, point is lots of ways to get interesting host information without sending
[30:29.160 --> 30:35.420]  any packets to the target. All right. All right, now about zero packet scanning. This is sort of
[30:35.420 --> 30:42.560]  meant as a joke. Zero packet scanning does not mean passive. Okay, I'm not talking about passive
[30:42.560 --> 30:49.040]  here. I'm not talking, I'm talking about zero packets from you, the source, to your target. So
[30:49.040 --> 30:53.580]  let's try to figure out some ways that we can actually do some recon without sending any packets
[30:53.580 --> 30:59.440]  directly to the target. It's about having fun with Google, remember when security was fun? Okay, so
[30:59.440 --> 31:07.480]  please no comments about the zero packet thing. All right. For example, DNS resolution isn't a big
[31:07.480 --> 31:13.400]  deal. Okay, port scanning is, that flags IDS monitor, so we don't want to do that crap. So
[31:13.400 --> 31:17.600]  let's find some interesting ways to get Google to help us out. Here you go, one Google query
[31:17.600 --> 31:23.440]  that finds forms that look like this. This form lets you send an email to somebody from somebody
[31:23.440 --> 31:28.360]  with a subject and a body and it comes from their web server. You do one Google query, you find this
[31:28.360 --> 31:35.140]  form, you fire off email from them. Isn't this fun? One Google query, find sites that'll gladly
[31:35.140 --> 31:40.880]  run the finger command for you. Notice I said that without opening myself to any finger jokes.
[31:42.680 --> 31:46.440]  One Google query, find sites that will actually ping for you.
[31:47.120 --> 31:51.860]  One Google query that will find sites that will gladly port scan a target for you.
[31:53.080 --> 31:57.020]  Zero packets from you to the target. You proxy your connection through this site,
[31:57.020 --> 32:03.140]  they're doing the port scanning, plus you're coming in proxy. Fun. How about this one? This
[32:03.140 --> 32:06.380]  one's a little long-winded, so I'm going to blow through it. Another site that lets you do port
[32:06.380 --> 32:14.160]  scanning, limited ports. See the limited ports? Here we go with more 1984 eliteness. What do you
[32:14.160 --> 32:20.720]  think the colon 81 on the end of that URL refers to? A port. And what do you suppose that little
[32:20.720 --> 32:29.380]  red dot that says port closed means? Port closed. So let's change the URL to 80 and we get a green
[32:29.380 --> 32:35.560]  dot which means port open. So we write a little script that actually fires through all those URLs
[32:35.560 --> 32:39.760]  to see which image is returned and we have an automated solution that actually bounces a port
[32:39.760 --> 32:44.620]  scan off of another site, zero packets from you to the target, you get your port scan at their
[32:44.620 --> 32:50.060]  expense. For example, you can even build an HTML page on your local workstation that looks like
[32:50.060 --> 32:57.640]  this if you really must have green and red dots to break into a site. Some of you do and that's okay.
[32:59.380 --> 33:04.020]  How about one Google query to find open proxy servers? Okay, when you run out of proxy servers
[33:04.020 --> 33:09.480]  to bounce all this crap off of, fire off a Google query and find some more. Open reverse squid
[33:09.480 --> 33:16.700]  proxies. Another CGI proxy, one query to find CGI proxies. Okay, this one's kind of fun. Please
[33:16.700 --> 33:22.880]  choose URL slash encoding and then they give you a little box and you put a URL in there and what
[33:22.880 --> 33:28.360]  do you know it bounces you to a site proxy style. Here I am viewing my website through a Chinese
[33:28.360 --> 33:35.460]  government proxy. Oh, did I say Chinese? I meant I was thinking about Chinese food and it just came
[33:35.460 --> 33:41.780]  out. Next slide, not the food, but the word. All right, here's one Google query that actually does
[33:41.780 --> 33:46.240]  all this stuff for you. Sites that'll do all this crap. Trace route, who is, fingers, NS lookup,
[33:46.240 --> 33:52.520]  hosts, DNS queries, digs. Again, one Google query, this site will do your bidding. Okay,
[33:52.520 --> 33:58.120]  this one will find NQT. I covered NQT last year. It's got some interesting limited functionality.
[33:58.360 --> 34:04.540]  But bottom line here is Jimmy Neutron actually turned this into a nice little Perl script to
[34:04.540 --> 34:10.380]  bounce scans off of an NQT server so that you can do all this stuff off of NQT. These tools are
[34:10.380 --> 34:15.120]  available from my website if you want to take a look at those. Okay, I'm skipping this one. This
[34:15.120 --> 34:20.540]  is basically a Java SSH client. You can do all sorts of nasty stuff with this, but it's from
[34:20.540 --> 34:27.660]  your machine. It's just kind of neat. So skip that. Oh, wait, come back. Is there a way to
[34:27.660 --> 34:33.200]  anonymously web crawl a target without pounding it with packets? Of course. How many of you have
[34:33.200 --> 34:39.580]  ever used a cache link? Keep your hands up. How many of you have ever read the banner at the top
[34:39.580 --> 34:46.880]  of the cache page? Good. I got to say the average is better than it was at Black Hat. All right.
[34:46.880 --> 34:51.200]  Now, for those of you that haven't read this page, shame on you, but let's figure out what happens
[34:51.200 --> 34:56.920]  when you click on a cache link. All right, here's a TCP dump. We click on a cache link. We make a
[34:56.920 --> 35:02.520]  connection to, in this case, the Frack website and to Google. Okay, so got some stuff going on.
[35:02.520 --> 35:10.120]  Question is, what was that that happened behind the scenes? What is this? It's an image. Okay, so
[35:10.120 --> 35:14.300]  up in the little header, Google was kind enough to tell you this cache page may reference images
[35:14.300 --> 35:19.680]  which are no longer available. Click here for the cache text only. So let's click here for the
[35:19.680 --> 35:25.500]  cache text only. Sniff it again. This time the entire conversation is between me and Google.
[35:25.780 --> 35:31.860]  We got the HTML off the site safely from Google without touching the Frack website. Bottom line
[35:31.860 --> 35:36.880]  here is it's very easy to get HTML content without sending any packets to the target.
[35:36.880 --> 35:42.100]  What you do with that content is wide open. Run regular expressions through it. Do whatever you
[35:42.100 --> 35:46.160]  want. Bottom line is you're not touching the target. You're talking to Google.
[35:47.820 --> 35:53.740]  Question is, what happened behind the scenes? Top URL is the cache link. Bottom URL is the cache text
[35:53.740 --> 35:59.660]  only. There's only one difference. It's got and strip equals one on the end. Okay, so let's see how
[35:59.660 --> 36:05.400]  we would do this in the real world. Right click on a cache link. Save the address to the clipboard.
[36:05.400 --> 36:10.940]  Paste it up to the address bar. Slap and strip equals one onto the end. And you're viewing the
[36:10.940 --> 36:16.480]  HTML of the web page without sending any packets to the target. Easy, right? No, it's not. You're
[36:16.480 --> 36:23.460]  supposed to say no, it's not. Okay, well, how about a Firefox plug-in that actually does this for you?
[36:25.680 --> 36:31.740]  All right, right click on any URL on any page and you get these nifty little options.
[36:31.740 --> 36:38.100]  Passive cache Google this link. What do you think that does? Okay, very nice plug-in written by
[36:38.100 --> 36:45.200]  Brian Baskins available from our website. Not from Google. I'll say Google. All right, so you right
[36:45.200 --> 36:49.760]  click on the link and it takes you to the passive cache Google image of that page. You don't have to
[36:49.760 --> 36:55.260]  hit the target. The one under that is nice too. Passive cache archive this link. How about pulling
[36:55.260 --> 37:00.360]  the page out of archive.org to see what it looked like in the past? Okay, so two very nice options
[37:00.360 --> 37:06.380]  for getting web pages without touching the target. Right, Firefox. So yes, you can do zero packet
[37:06.380 --> 37:11.600]  recon against the target. And we're flying, we're not letting you read, we're going on.
[37:13.400 --> 37:17.500]  Yeah, I'll talk about this. This is kind of neat. I didn't necessarily invent this thing, but it's
[37:17.500 --> 37:22.900]  it's kind of a neat situation. Let's say you go to a web page that you find in Google and it's down.
[37:22.900 --> 37:27.260]  You click the cache link and sometimes the cache link's even broken. Sometimes you get that error
[37:27.260 --> 37:33.260]  message. Well, the question is, is there any way we can recreate that web page without, you know,
[37:33.260 --> 37:37.940]  without hurting ourselves? And the answer is cache sliding. Somebody else came up with this and
[37:37.940 --> 37:42.500]  with all my Google skills I couldn't for the life of me figure out who it was. So if you know, please
[37:42.500 --> 37:48.120]  tell me so you don't think I'm making this up as my own uber eliteness stuff. All right, so we have
[37:48.120 --> 37:52.580]  this query. We can rebuild the web page just from the snippet. The way you do it is pretty
[37:52.580 --> 37:58.540]  straightforward. What you do is you find the page that you're looking for, you narrow down the page
[37:58.540 --> 38:04.260]  with a query, and you actually throw words from the snippet on the tail end of your query. Okay,
[38:04.260 --> 38:09.520]  it's pretty straightforward. But what you do is you keep sliding your search queries forward so
[38:09.520 --> 38:14.120]  that you can read more and more of the snippet. So for example, you can see I queried for natives
[38:14.120 --> 38:21.560]  project next to each other, right? The next query I query for album entitled. Notice it's showing me
[38:21.560 --> 38:28.100]  before and after my search term. I'm recreating the web page without the web page even being there.
[38:28.100 --> 38:33.060]  The cache is gone. The real web page is gone. Bottom line is you keep sliding it forward and
[38:33.060 --> 38:39.500]  forward until you recreate the entire web page. All right, neat stuff. Just a quick second about
[38:39.500 --> 38:47.080]  this user agent spoofing. It's entirely possible for you to change your user agent to make your
[38:47.080 --> 38:52.420]  browser look different. How many of you have ever changed your user agent to Googlebot? Excellent.
[38:52.420 --> 38:58.220]  Nobody at Black Hat raised their hands. That's pretty cool. Well, surfing the net as Googlebot
[38:58.220 --> 39:04.120]  has some interesting ramifications. For one, lots of badly configured sites like forums and news
[39:04.120 --> 39:09.700]  sites actually lock people out depending on what their user agent is. For example, you got this
[39:09.700 --> 39:14.740]  advertising on your site, right? You want Google to see your advertising and all that garbage and
[39:14.740 --> 39:19.800]  be able to troll through your forum so that it can send visitors your way, all right? But you
[39:19.800 --> 39:24.520]  want users to actually sign up for an account. So you block anybody that comes in that doesn't
[39:24.520 --> 39:29.380]  have Googlebot as their user agent. So if you want to view the site, set your user agent to
[39:29.380 --> 39:34.180]  Googlebot and you traipse right into the site as the Googlebot and get whatever you want.
[39:34.280 --> 39:41.380]  Now, these people ain't too bright. I'll be the first to admit it. This is not security,
[39:41.380 --> 39:47.260]  okay? I don't think it was meant to be. And a lot of sites do this cloaking a better way,
[39:47.260 --> 39:51.520]  which is you look at the user agent plus you look at the IP they came from, see if it came from
[39:51.520 --> 39:56.920]  Google. That's a better way to do it. But bottom line is you can have an awful lot of fun with this.
[39:57.660 --> 40:04.660]  All right, the fireworks show. Welcome to the Google Hacking Showcase 2005.
[40:04.840 --> 40:09.420]  All you people that are sleeping, wake up now. There you go.
[40:11.080 --> 40:16.600]  Let the games begin, the best and worst of this year. All right, let's start pretty easy. How
[40:16.600 --> 40:22.600]  about VNC servers? How many of you have used VNC or know what it is? Yeah. You install it on your
[40:22.600 --> 40:27.660]  server, you install a client, you point it at your server, you control the keyboard and the mouse.
[40:27.660 --> 40:31.660]  It's pretty nice. It requires a username, it requires a password, it requires you to know
[40:31.660 --> 40:36.940]  the port that it's listening on. All right, how about one query that finds real VNC servers that
[40:36.940 --> 40:42.300]  will actually send you down a Java-based client that you can use and is also nice enough to fill
[40:42.300 --> 40:48.960]  in the hostname and the port that you should connect to, right? And one modification to the
[40:48.960 --> 40:53.800]  query, and guess what? You can find sites that have no username or password associated with them.
[40:53.860 --> 40:58.380]  One Google query, you're moving the keyboard and the mouse. Anybody that has doubts about it being
[40:58.380 --> 41:05.640]  called Google Hacking, just go. All right, thank you. All right, this one's weak. Next, print
[41:05.640 --> 41:13.380]  servers. Dang, got it. My laptop even thought it was weak. All right, one query that actually
[41:13.380 --> 41:19.380]  finds access print servers. Now, print servers are boring little beasts, you know, unless you're
[41:19.380 --> 41:26.140]  FX and those folks that do really ungodly things to printers. But printers get a really bad
[41:26.140 --> 41:32.780]  rap. Now, I'm going to show you some more Oday here. This is really elite stuff. Press, you
[41:32.780 --> 41:39.780]  should start writing right now. Five minutes? All right, let's fly. All right, the zero day here is
[41:39.780 --> 41:46.320]  you actually click on that little oval right there with your thing that's a mouse, right? You click
[41:46.320 --> 41:52.300]  the left button with your finger and you aim it at that little oval that says configuration wizard
[41:52.300 --> 41:59.440]  and what do you think happens? It orders Chinese. No, not really. You enter configuration management.
[41:59.440 --> 42:05.420]  How about webcams? I hate freaking webcams. These webcams, however, are really interesting. This
[42:05.420 --> 42:11.640]  gives shoulder surfing a new name. This one's nice because it's pointing at big barrels of
[42:11.640 --> 42:18.420]  explosive looking things and it has a laser button there. All right, so you can shoot the things.
[42:21.160 --> 42:26.380]  I'm pretty sure that's what, I didn't click it, but all right. Anyway, this is the inside of a
[42:26.380 --> 42:33.020]  tactical nuclear submarine. No, not really. But it's like eBay or something. I don't know.
[42:33.020 --> 42:39.940]  Very interesting. How about this one? A speed stream DSL router. Very nice. Again, here we go
[42:39.940 --> 42:44.240]  with the uber hacker tricks. Please do not print this in the press. What you do is you take the
[42:44.240 --> 42:55.730]  mouse, left button again, and you click on that oval. It says disconnect. Yeah, what do you think
[42:55.730 --> 43:01.130]  happens? Yeah, bye-bye. All right, how about this one? A Belkin router. One query finds Belkin
[43:01.130 --> 43:05.210]  routers that are misconfigured. You can lock them out of their own wireless network for their own
[43:05.210 --> 43:19.620]  safety. All right, how about this one? Who can guess the system password on this box?
[43:26.210 --> 43:34.490]  Yeah, that's bad news. This is a query that finds a Windows small business server. Attention,
[43:34.490 --> 43:39.030]  this site is for employee use. Only public access to our website can be found by clicking here. So
[43:39.030 --> 43:45.350]  you're supposed to, you know, be there and not here. But anyway. All right. Boring. Next. Pivot
[43:45.350 --> 43:50.310]  software. This one, this Google query lets you find pages that let you set up the administrator
[43:50.310 --> 43:58.230]  user. And again, left button, little oval, proceed to log in, create an admin account. Got it.
[43:58.410 --> 44:02.970]  Boring. Next. Printers. The printers suck unless you can see the print jobs that they're actually
[44:02.970 --> 44:07.230]  printing. How about these? Microsoft Word documents. Some have to do with religion,
[44:07.230 --> 44:15.090]  some have to do with aphrodisiacs. Problem was it was the same user. Not sure. This is like a
[44:15.090 --> 44:19.530]  distributed denial of service. You find a printer that lets you do all this stuff to it. You turn
[44:19.530 --> 44:29.050]  on NetWare and AppleTalk at the same time. It's just, it's just evil. One query to find
[44:29.510 --> 44:35.770]  firewalls. How about smoothwall and IP cops that need updating? Snort IDS front ends. How many of
[44:35.770 --> 44:42.390]  you know about that Cisco problem? Yeah, it's, there's a lot of technical stuff into how that
[44:42.390 --> 44:46.890]  works. You can probably do something similar with a query like this to just find open Cisco
[44:46.890 --> 44:55.030]  devices for people that are stupid. Open switches. Yep. PHP nuke is very nice. How about this one?
[44:55.030 --> 45:00.530]  A query that finds PHP nuke sites. There are no administrator accounts yet. Proceed to create
[45:00.530 --> 45:06.990]  them by clicking here. Yeah, for security reasons it is best that you create the super user right
[45:06.990 --> 45:15.760]  now by clicking here. Parking lot Nazi cam. This is so you can see the CIO vault over his
[45:15.760 --> 45:20.240]  convertible when he comes into the building from the handicapped parking spot. Okay, more security
[45:20.240 --> 45:26.680]  cameras. Multiple camera views including one called Woody. I didn't click. I didn't click.
[45:27.440 --> 45:32.820]  Time-lapse video recorders. That's not the end of my presentation. You guys knew I was out of time
[45:32.820 --> 45:36.900]  so you went right to the end of my presentation. All right, we are very close to the end. Sorry
[45:36.900 --> 45:50.280]  for the next person. Very sorry. Going back. We're going back. Okay, let's go to the...
[45:54.870 --> 45:57.550]  Ah, here we go. Sorry, it will be worth the wait.
[45:57.550 --> 46:04.030]  There we go. All right, I won't press the wrong button again. One query that lets you find...
[46:05.330 --> 46:08.710]  I don't know what this is, but I think that stands for master bedroom.
[46:09.730 --> 46:14.190]  How about this one? One query that lets you find e-power switches, web-controlled sockets
[46:14.190 --> 46:18.250]  in somebody's house, electrical sockets, Google for the default password,
[46:18.250 --> 46:21.770]  and you get these rectangular buttons, which it's sort of like crypto.
[46:24.670 --> 46:28.990]  You click the rectangle in this case that says power and restart.
[46:30.070 --> 46:35.290]  Yeah, all right. How about this one? Lots more things to turn off, including things like
[46:35.830 --> 46:40.910]  on and off buttons. These are ovals, easy to find. Turn off lamps and motion detectors.
[46:41.290 --> 46:46.330]  You can even turn off their media rack, their aquarium, and their electric bong.
[46:46.890 --> 46:59.950]  How about this one? One click to turn off somebody's Christmas lights.
[47:00.410 --> 47:06.450]  It's just rude. Usernames and passwords. How about digital camera image dumps from cell phones,
[47:06.450 --> 47:13.770]  Sprint, T-Mobile, Counter-Strike server configs with clear text passwords, MSN contact lists,
[47:13.770 --> 47:20.430]  how about vCalendar files, MSN ccMail mailbox files, open SQL servers, no username or password
[47:20.430 --> 47:26.810]  required, point and click, own the database. SQLite, same deal. Netscape history files,
[47:26.810 --> 47:33.110]  including clear text pop passwords. And the surfing list, which includes IBM and hotchicks.com.
[47:34.470 --> 47:39.970]  How about this one? These are sysprep.in files that actually show the clear text admin password
[47:39.970 --> 47:46.430]  and the product ID for Windows that they use to install it. All right, that's a good one. Yeah.
[47:46.430 --> 47:54.170]  How about IPSec final encryption keys? VPN user profiles. Now, VPN is very secure,
[47:54.170 --> 47:58.390]  so these are encrypted. Unfortunately, though, these are not.
[48:00.050 --> 48:07.210]  How about Nessus scan output? Explorer windows, yes, that does say WinNT system 32. And yes,
[48:07.210 --> 48:09.670]  the oval does read delete.
[48:16.600 --> 48:20.240]  All right, police reports, sensitive government documents, yes,
[48:20.240 --> 48:26.720]  sensitive government documents are on the web. How about this one for the FOUO raincoat?
[48:27.100 --> 48:32.980]  The FOUO ensemble? The step-by-step instructions for putting on the coat,
[48:32.980 --> 48:37.500]  which should be classified, I think. And whatever the hell this guy's doing.
[48:39.260 --> 48:43.140]  I don't know what he's doing, but he's probably smiling, and that's rated a 10.
[48:43.140 --> 48:50.840]  Yeah. Government research project, this is Boba Fett. The Silence of the Lambs guy.
[48:51.740 --> 48:55.640]  Darth Vader with the drinking attachment.
[48:57.040 --> 49:01.540]  If Darth Vader's at DEF CON, and he wants to drink, he shouldn't have to show his ugly head
[49:01.540 --> 49:06.280]  now, should he? All right, so yeah, we got all sorts of stuff. How about this one? Authorized
[49:06.280 --> 49:11.920]  user only. I'm at the end of the presentation again. Yes, it did say authorized user only.
[49:11.920 --> 49:16.080]  Do not distribute, do not put on web. I am completely out of time, but let's do our last
[49:16.080 --> 49:23.720]  two slides here. For a shirt, can anyone guess what this username and password should be to break
[49:23.720 --> 49:32.720]  in here? All right. Very good. Next one. Next one's a little bit easier. How about...
[49:35.040 --> 49:43.100]  how about... there we go. Sorry, I'm out of time, guys. All right. Yes. How do you break
[49:43.100 --> 49:50.060]  into this site, folks? It says admin equals false in the URL. Yeah, let's change it to
[49:50.060 --> 49:53.560]  admin equals true, and congratulations, you now have access.