WEBVTT 00:03.040 --> 00:04.240 All right. 00:04.420 --> 00:05.220 Thanks for coming. 00:05.220 --> 00:08.680 My name is Johnny Long, in case you're in the wrong spot. 00:10.580 --> 00:13.700 Presentation today is called Google Hacking for Penetration Testers. 00:13.700 --> 00:15.360 How many of you have seen me speak before? 00:15.620 --> 00:16.400 Show of hands. 00:16.400 --> 00:16.840 Okay. 00:16.840 --> 00:19.720 How many of you have seen me speak on the topic of Google? 00:20.440 --> 00:21.140 Okay, cool. 00:21.140 --> 00:23.740 Thanks for coming and seeing me speak about Google again. 00:25.460 --> 00:26.640 Next year it'll be different. 00:26.640 --> 00:27.520 It'll be Yahoo. 00:30.420 --> 00:36.940 I have about an hour and a half talk here, which I'm told is just not possible. 00:37.240 --> 00:39.800 So I'm going to be flying through some stuff early on. 00:39.800 --> 00:41.760 The format of the talk is pretty straightforward. 00:41.800 --> 00:45.000 I go through some technical mumbo-jumbo in the beginning. 00:45.340 --> 00:49.680 It's a little bit dry, so for those of you that aren't technical, feel free to nap then. 00:50.200 --> 00:54.400 Because things get interesting towards the end and we have a nice firework show at the end. 00:54.400 --> 00:57.580 So those of you that nap, do it now. 00:58.400 --> 01:10.540 Also, after the talk, in the next room, just on the other side of this wall, we're going to do a book signing for the book by the same name written by some guy named Johnny that has gotten decent reviews and has lots of pretty pictures. 01:11.180 --> 01:13.120 So you might want to check that out. 01:13.120 --> 01:14.780 So I'll be doing a book sign across the wall. 01:15.380 --> 01:17.100 Also, we're going to be doing a contest. 01:17.320 --> 01:19.600 This worked out fairly well for Black Hat. 01:20.220 --> 01:21.740 I expect it to work out. 01:21.740 --> 01:22.860 Oh, cell phone rules. 01:22.860 --> 01:26.300 For every ring of a cell phone, it's $5 to a charity of my choice. 01:26.840 --> 01:28.100 That usually works. 01:28.480 --> 01:30.680 We're going to be doing a live Google hacking contest. 01:30.680 --> 01:40.560 For those of you that know a little bit about this topic and have come armed to actually win some prizes in the form of books from Syngress, I have two folks in the back that are helping me out. 01:41.560 --> 01:44.300 Hey Josh, Josh and Nick, can you put your hands up? 01:44.300 --> 01:46.500 Back here, against the wall. 01:46.500 --> 01:50.740 If you guys are interested in entering the Google hacking contest, here's what we're looking for. 01:50.740 --> 02:02.000 Interesting queries that are not already public, that cough up sensitive information, sort of a gentleman's agreement that they actually work and that they're actually unique. 02:02.100 --> 02:02.960 But here's the deal. 02:02.960 --> 02:08.760 To claim your prize, you need to come up in front of all these people and in front of that camera to claim your prize. 02:09.320 --> 02:15.060 We will have your email address and we'll inform all the other contestants of your cheating, lying ways. 02:16.220 --> 02:19.240 And we will give them your email address, so be warned. 02:19.500 --> 02:27.040 But anyway, seriously, if you guys have some interesting queries that you'd like to send to the guys in the back, we've got lots of prizes that we'd be happy to hook you up with. 02:27.380 --> 02:29.420 Alright, so let's dig in. 02:30.640 --> 02:32.760 This is the part that I'm going to go short on. 02:32.760 --> 02:34.200 How many of you have used Google? 02:34.480 --> 02:35.440 Show of hands. 02:38.400 --> 02:40.580 Everybody else has to leave, that's it. 02:41.500 --> 02:44.700 Alright, how many of you have used Google with advanced operators? 02:44.820 --> 02:45.580 Show of hands. 02:45.580 --> 02:46.460 Good, excellent. 02:46.460 --> 02:48.580 So I will go pretty light with this. 02:48.580 --> 02:50.660 Advanced operators are pretty straightforward. 02:50.720 --> 02:54.500 You basically put them right in with your query, just like your other search terms. 02:54.640 --> 02:58.440 The syntax is an operator followed by a colon followed by a thing. 02:58.440 --> 03:00.320 I'll call it a search term. 03:00.320 --> 03:02.400 There's no space before or after the colon. 03:02.400 --> 03:05.460 So let's get an idea of what some of the operators are. 03:05.480 --> 03:08.640 This is ripped right from a Singris book. 03:08.820 --> 03:11.360 It's the first time I ever enjoyed copyright infringement. 03:11.360 --> 03:12.340 It felt great. 03:13.960 --> 03:25.420 Anyway, you've got all the operators down the left-hand side, what the operator is, followed by the purpose of the operator, followed by a couple things that identify where the operator can be used and whether or not it plays nicely with the other operators. 03:25.820 --> 03:30.760 One of the things you'll realize when you start messing with this stuff is that some operators are just plain nasty. 03:30.800 --> 03:32.960 They just don't like to be messed around with. 03:32.980 --> 03:35.500 So this table sort of helps sort things out. 03:35.880 --> 03:39.520 But here's how... I'm going to skip this one because this is a bad demonstration. 03:40.500 --> 03:43.660 Here's how advanced operators can work. 03:43.880 --> 03:45.860 And by the way, I have 209 slides. 03:45.860 --> 03:47.640 Does anybody have more than that at DEF CON? 03:49.080 --> 03:49.720 Sweet. 03:49.780 --> 03:51.460 I have PowerPoint foo. 03:53.080 --> 03:54.660 Alright, we will get through them all. 03:54.920 --> 03:57.420 Alright, let's use advanced operators to actually find this page. 03:57.420 --> 03:59.120 This is a page from my website. 03:59.360 --> 04:03.320 And what I'm going to do is I'm actually going to define this page with advanced operators. 04:05.960 --> 04:07.240 That's true. 04:07.700 --> 04:11.000 My PowerPoint foo skills are gone now. 04:13.480 --> 04:16.740 You will be able to get this off my website after the conference. 04:16.740 --> 04:24.360 I felt very uncomfortable pushing the 40 megs worth of Google joy up on my server with all of you evil people around. 04:24.980 --> 04:27.320 After the con, you guys can pick it up. 04:27.380 --> 04:28.720 I have yo-yo skills, though. 04:32.990 --> 04:35.090 So let's define this page. 04:35.090 --> 04:35.550 Here you go. 04:35.550 --> 04:36.850 In title, I hack stuff. 04:36.850 --> 04:37.790 Notice we're using a phrase . 04:37.790 --> 04:39.470 We're looking for a phrase in the title. 04:39.830 --> 04:42.450 I'm building a Google query here to define the page. 04:42.450 --> 04:43.670 File type, PHP. 04:43.670 --> 04:45.270 This is a PHP page. 04:47.410 --> 04:48.430 Num range. 04:48.690 --> 04:52.970 Num range got a lot of press last year through no fault of my own. 04:53.010 --> 05:00.110 And I still won't describe the evil uses of num range, but if you haven't figured it out by now, all hope is lost for you. 05:00.610 --> 05:02.810 But num range is absolutely evil. 05:03.270 --> 05:03.990 I know you. 05:05.770 --> 05:08.810 I think you're going to need to come up here and drink that if you're bringing it up. 05:09.070 --> 05:09.510 Yeah. 05:09.510 --> 05:10.250 Come on. 05:11.290 --> 05:12.970 Who wants Mudge to sit up here? 05:20.070 --> 05:20.710 Okay. 05:21.630 --> 05:22.970 What are you going to do with my DNA? 05:24.250 --> 05:25.610 I've already got it elsewhere. 05:30.860 --> 05:32.400 None of you heard that. 05:34.160 --> 05:34.820 All right. 05:34.820 --> 05:35.700 On with the show. 05:36.380 --> 05:38.080 Let's go a little bit farther in text. 05:38.180 --> 05:43.760 Navigate in text is a little bit goofy because in text sort of does what you think Google searching normally does. 05:43.760 --> 05:45.880 It finds stuff in the text of a web page. 05:45.900 --> 05:52.620 But the bottom line here is you throw all of this crap together into one big nasty query and you get something that looks like this. 05:52.620 --> 05:53.520 One result. 05:53.520 --> 05:58.320 You've basically used advanced operators to narrow down your search very efficiently. 05:58.920 --> 06:00.120 So there we go. 06:00.120 --> 06:00.660 One hit. 06:00.860 --> 06:03.440 That's advanced Google searching. 06:03.500 --> 06:06.920 I've gotten a lot of flack about the term Google hacking. 06:06.920 --> 06:08.460 So let's show where the line is. 06:08.840 --> 06:14.300 Google hacking basically is looking for pages that look something like this. 06:14.600 --> 06:17.020 Can anybody tell me what this URL might describe? 06:23.180 --> 06:24.080 Thank you. 06:24.080 --> 06:24.640 Thank you. 06:24.640 --> 06:25.840 Thanks so much. 06:26.900 --> 06:27.480 Okay. 06:27.480 --> 06:29.280 I'm here in e-commerce, right? 06:30.060 --> 06:31.060 Shopping cart. 06:31.060 --> 06:31.540 Yeah. 06:31.980 --> 06:33.240 I hear credit cards. 06:33.240 --> 06:34.140 There you go. 06:34.180 --> 06:34.400 Yeah. 06:34.400 --> 06:37.800 This is basically... well, we'll show you what it describes, but here's the query. 06:37.900 --> 06:41.860 In URL admin, in URL orders, file type PHP. 06:42.060 --> 06:42.920 It's a nice query. 06:42.920 --> 06:43.600 Throw it into Google. 06:43.600 --> 06:45.400 You find pages that look like this. 06:45.520 --> 06:47.160 It's the back end of an e-commerce site. 06:47.160 --> 06:49.780 It's the administrative page for an e-commerce site. 06:49.840 --> 06:51.080 So you've got customer orders. 06:51.080 --> 06:52.040 You've got order amounts. 06:52.040 --> 06:53.300 You've got ship dates. 06:53.540 --> 06:53.720 Okay. 06:53.720 --> 06:58.800 And then on the bottom right, you can see we've got payment details including bank information, credit card information. 06:59.120 --> 06:59.420 Okay. 06:59.420 --> 07:01.520 This is the heart and soul of Google hacking. 07:01.520 --> 07:09.520 It's basically using Google, first of all, to do things that it wasn't necessarily designed to do, and secondly, find things that aren't necessarily public. 07:09.820 --> 07:10.580 All right. 07:10.800 --> 07:20.760 Now, I came up with this interesting term called Google dork, which by my own definition is a foolish or inept person as revealed by Google. 07:20.920 --> 07:21.800 All right. 07:21.820 --> 07:28.180 So the term Google dork has gotten pretty popular despite the fact that Google has not put it on their web page anywhere. 07:28.900 --> 07:34.300 But it's become obvious lately that Google has started blocking queries. 07:34.640 --> 07:35.020 Okay. 07:35.020 --> 07:41.320 And I call the blocking of malicious queries the GDDS for the Google dork detection system. 07:44.000 --> 07:45.320 This is just a blurb. 07:45.320 --> 07:46.380 I'm going to fly past this. 07:46.380 --> 07:52.640 This is basically legalese so that the white hats in the community don't yell at me for, you know, revealing this thing. 07:52.640 --> 07:55.760 Bottom line is, Google's blocking queries. 07:55.760 --> 07:59.960 They've never before stepped into this game of messing with your queries. 07:59.960 --> 08:00.180 Okay. 08:00.180 --> 08:07.660 They've been in the ivory, I don't want to say ivory tower, it's got negative connotations, but they've never jumped into the security game before until now. 08:07.660 --> 08:12.020 Well, the problem that I have with that is that they're not doing it very well. 08:12.020 --> 08:13.380 Let's take a look at why. 08:13.540 --> 08:16.500 Anybody run into a page like this when they're doing a Google query? 08:16.620 --> 08:17.640 Show of hands. 08:18.000 --> 08:18.660 Anyone? 08:18.660 --> 08:20.020 You all are evil. 08:20.020 --> 08:21.240 Everyone look around. 08:21.540 --> 08:23.620 People with their hands up are evil. 08:24.080 --> 08:24.540 Okay? 08:26.440 --> 08:31.400 This screen comes up when you try a malicious query and Google just doesn't like it. 08:31.400 --> 08:34.740 So what we're going to do is we're going to actually try to bypass this screen. 08:34.820 --> 08:37.820 So this was for inurladmin.php. 08:37.860 --> 08:41.240 This is what the query looks like in the form of a URL up at the top. 08:41.240 --> 08:45.400 Down the middle, for those of you in the back that can't see, I've basically highlighted the query part. 08:45.400 --> 08:49.140 It says inurl colon admin dot php. 08:49.160 --> 08:54.440 Well, here's uber hacker trick oday of the talk number one. 08:54.480 --> 08:55.020 Okay? 08:55.440 --> 08:57.220 I've got lots of them. 08:57.540 --> 09:00.380 Unfortunately, this is like oday from like 84. 09:01.440 --> 09:02.160 All right. 09:02.160 --> 09:07.340 So our first bypass technique involves just changing the case of any of the words in the query. 09:07.460 --> 09:11.740 So how about admin dot capital php? 09:12.840 --> 09:16.280 So what do you think happens when we fire off any of these queries? 09:17.100 --> 09:19.240 Lo and behold, it goes through. 09:19.380 --> 09:20.060 Okay? 09:20.060 --> 09:29.700 Now, I'm not going to pick on Google too much for this one because about two days after I talked about this in Japan for Black Hat, magically this got fixed. 09:29.700 --> 09:31.480 Which was cool. 09:31.480 --> 09:32.880 I counted that as a personal victory. 09:32.880 --> 09:34.660 I was like, all right, well, let's keep going. 09:34.660 --> 09:35.820 So that was round one. 09:36.020 --> 09:37.880 Let's talk about round two. 09:38.940 --> 09:40.880 Round two is query shifting. 09:40.880 --> 09:43.060 Here's an interesting query. 09:43.120 --> 09:48.980 This one is for a index dot php file that has php bb2 somewhere in the URL. 09:48.980 --> 09:49.960 And they block it. 09:49.960 --> 09:51.020 Malicious query. 09:51.300 --> 09:53.380 So call this query shifting. 09:53.380 --> 09:59.940 Basically what I'm going to do is I'm going to use the same query for all intents and purposes, but I'm going to use different operators. 09:59.940 --> 10:07.100 So I'm going to look for php bb2 in the URL still, a file type of php and the word index. 10:07.320 --> 10:10.160 It's essentially the same query and it goes through. 10:10.160 --> 10:13.640 Shift around Google's operators, make the search a little bit different, it goes through. 10:13.640 --> 10:14.740 Query shifting. 10:15.780 --> 10:18.200 This one's my personal favorite. 10:18.420 --> 10:24.760 Some of these are getting fixed, like as we speak, some of them are still lingering, so your mileage may vary. 10:24.760 --> 10:28.480 But anyway, powered by php bb gets blocked. 10:29.280 --> 10:31.760 Now, this is a leap . 10:31.760 --> 10:33.480 Just wait for it. 10:33.480 --> 10:36.360 Check out what you do to get the query to go through. 10:42.660 --> 10:43.400 Okay . 10:43.400 --> 10:48.360 Putting spaces between the letters and the word powered lets the query go through. 10:48.360 --> 10:51.340 Now, you would think that this would just not work. 10:51.340 --> 10:53.960 Google would take one look at this and go, you're a frigging idiot. 10:55.180 --> 10:59.020 Well, they do it nicely and it would be in pleasing colors that weren't offensive. 10:59.040 --> 11:02.520 But, you know, normally they'd like fix it for you. 11:02.520 --> 11:05.140 Well, Google does actually fix this query for you. 11:05.140 --> 11:10.800 They take one look at it and they're like, what you meant to say was powered, but hold on, let me check the query to see if it's evil. 11:10.800 --> 11:11.640 Not evil. 11:11.640 --> 11:17.840 Okay, I'm going to fix it so that I'm searching for what you're looking for and I'm going to search for powered by php bb. 11:17.840 --> 11:24.680 You can tell it's searching for that because down in the actual query results, it highlights the words powered by php bb. 11:25.600 --> 11:27.580 I'm telling you, oday from 84. 11:28.720 --> 11:29.460 All right. 11:29.580 --> 11:34.920 Here's another example, same thing, powered by php bb2, blah, blah, blah, throw some spaces in there. 11:34.920 --> 11:38.040 It also works if you throw pluses between the letters in the URL. 11:38.100 --> 11:39.360 That's also elite. 11:40.880 --> 11:43.600 How many of you have seen this message? 11:44.080 --> 11:45.360 Show of hands. 11:45.700 --> 11:46.340 Okay. 11:46.340 --> 11:49.160 Those 10 people are really evil. 11:49.200 --> 11:49.720 All right. 11:49.720 --> 11:53.500 This is the message that you get when you violate Google's terms of service. 11:54.080 --> 11:55.740 That you've all read. 11:58.540 --> 11:59.740 You're laughing at me. 11:59.740 --> 12:00.940 I saw a lot of hands. 12:00.940 --> 12:03.720 I saw a lot of people in the audience say, yeah, you're Google users. 12:03.720 --> 12:07.400 So how many of you Google users have read the terms of service? 12:08.320 --> 12:09.600 That's what I thought. 12:10.580 --> 12:11.340 Yeah. 12:11.340 --> 12:11.740 All right. 12:11.740 --> 12:15.060 Well, Google's terms of service says don't do automation. 12:15.120 --> 12:16.380 That's the long and short of it. 12:16.380 --> 12:17.460 They give you some alternatives. 12:17.460 --> 12:19.020 The alternatives sort of suck. 12:19.080 --> 12:20.680 But they say don't do automation. 12:20.680 --> 12:24.360 I got this message by actually curling for a Google query. 12:24.480 --> 12:25.600 I used curl. 12:25.680 --> 12:26.660 There's my query. 12:26.660 --> 12:30.460 Fired it into poo.html, which doesn't mean anything, by the way. 12:30.820 --> 12:32.040 And I viewed the page. 12:32.040 --> 12:33.740 And we get this forbidden message. 12:33.820 --> 12:40.280 Now, can anybody tell me exactly what's different between curl and any other web browser that Google might be interested in? 12:40.700 --> 12:41.760 Thank you. 12:42.360 --> 12:42.980 Oday. 12:42.980 --> 12:43.800 Here we go. 12:43.800 --> 12:49.140 How about if you throw a user agent into curl and actually try it again, what do you think happens? 12:50.740 --> 12:51.540 Yeah. 12:51.660 --> 12:52.900 Throw a user agent in there. 12:52.900 --> 12:54.620 Now, I threw a really nice user agent in there. 12:54.620 --> 12:55.680 I did a little bit of research. 12:55.680 --> 12:56.640 Got out my sniffer. 12:56.640 --> 12:58.020 I was feeling all Uber. 12:58.080 --> 13:00.900 I'm like, ooh, look at the nice user agent for my browser. 13:00.960 --> 13:02.000 Copied into curl. 13:02.000 --> 13:03.280 I'm like, yeah, I'm the man. 13:03.460 --> 13:08.620 And then I started thinking, you know, I really can't type as well as I used to. 13:08.620 --> 13:10.100 And I actually looked at my curl command line. 13:10.100 --> 13:11.180 I had this typo in there. 13:11.180 --> 13:15.400 I actually had a F space Firefox as my web browser. 13:15.420 --> 13:21.560 And then I thought to myself, I wonder what happens if I just throw, you know, like poo in there as the user agent. 13:21.560 --> 13:22.440 What would happen? 13:22.640 --> 13:24.100 Take a guess what happens. 13:24.520 --> 13:25.460 It works. 13:25.460 --> 13:25.840 All right. 13:25.840 --> 13:29.960 So, Google's looking at the user agent, but they don't give a fly and flip exactly what you put in there. 13:29.960 --> 13:32.560 It just has to be in there somewhere, which makes sense. 13:32.560 --> 13:35.240 They don't want to block the newest browsers from getting search results. 13:35.240 --> 13:38.100 So, anyway, that's how you get past some automation. 13:38.840 --> 13:39.040 All right. 13:39.040 --> 13:40.300 Question is, why do this? 13:40.300 --> 13:42.940 Bottom line is, Google's not going to protect you from evil searches. 13:42.940 --> 13:45.240 You got to take the battle into your own hands. 13:46.560 --> 13:47.000 All right. 13:47.000 --> 13:47.960 Let's keep moving. 13:48.380 --> 13:51.760 I'm going to fly through this, because this is pretty basic stuff. 13:51.760 --> 13:54.980 And it was fluff for the people at Black Hat, because they're not as smart as you guys. 13:56.340 --> 13:57.320 Just kidding. 13:57.540 --> 13:58.240 All right. 13:58.240 --> 14:02.640 Bottom line is, there's some interesting things you can do if Google queries just don't work out for you. 14:02.640 --> 14:05.180 This is an example of a query looking for email addresses. 14:05.180 --> 14:08.040 We're some spam troll, and we're out there looking for email addresses. 14:08.040 --> 14:10.060 So, we look for at gmail.com. 14:10.060 --> 14:11.980 Well, Google throws away the at sign. 14:12.160 --> 14:12.360 Okay. 14:12.360 --> 14:25.100 The bottom line is, there's lots of data out there in Google that can be mined very effectively for all sorts of different things, and can be mined in such a way as to not send any packets to the target that you're trying to get more information about. 14:25.140 --> 14:26.820 We'll talk about anonymity in a minute. 14:26.820 --> 14:40.120 Bottom line is, if Google queries don't work for you, and yeah, this is really elite, too, you know, using a regular expression on an HTML file dump of a query page gets you the same result. 14:40.120 --> 14:48.320 For example, I use links to actually do the same query, pull the results down, and then I look in that file for gmail addresses using a regular expression. 14:48.340 --> 14:48.740 Okay. 14:48.740 --> 14:49.860 Pretty straightforward. 14:50.120 --> 15:00.000 But the bottom line is, this is a little bit, you know, it's a little bit hard doing it this way, you know, with links, but if you search more and more pages, you can actually get more results. 15:00.000 --> 15:05.200 Actually, this one was done with a program called Email Miner from SensePost. 15:05.200 --> 15:07.200 How many saw the SensePost talk today? 15:08.000 --> 15:08.600 Okay. 15:09.160 --> 15:17.400 SensePost has a really cool tool called BidiBlah, which they released today, and they do a lot of things to actually do open source information gathering about targets using Google. 15:17.400 --> 15:21.640 Basically, what I'm doing here is, I'm showing you some of what they do behind the scenes. 15:22.240 --> 15:28.060 You know, there's nothing terribly technical about it, but it's an interesting way to actually profile a target. 15:28.520 --> 15:33.020 So, lots of email addresses, we troll through more results, we get more hits. 15:33.020 --> 15:37.700 I threw this in there because it's just funny, and I like ripping stuff out of people's books. 15:38.680 --> 15:43.980 Other places to find email addresses, how about Excel spreadsheets called email.xls? 15:44.900 --> 15:46.900 Yeah, I like that one. 15:46.900 --> 15:48.860 How about Outlook address books? 15:49.720 --> 15:51.140 Yeah, you name it, it's in there. 15:51.140 --> 15:55.340 How about registry files that actually have internet account management? 15:55.720 --> 15:57.720 Pop three passwords in there. 15:57.760 --> 15:59.020 All sorts of places. 15:59.060 --> 16:08.020 Well, the same thing can actually be done to map a network, and this gets a little deeper, but the process of actually mapping out a network might look something like this. 16:08.020 --> 16:12.860 You get a list of targets, you find related targets, perhaps outside that domain. 16:12.860 --> 16:15.600 Those of you that saw SensePost talk sort of know where this is going. 16:15.700 --> 16:19.020 You expand that list of targets using a couple different methods. 16:19.020 --> 16:22.000 We're going to look at a couple different ways to do this. 16:22.000 --> 16:28.100 You verify those targets, you discover more targets, and you do vitality scans to see if they're up. 16:28.100 --> 16:29.860 That's sort of how the process works. 16:29.920 --> 16:32.700 Let's look at some interesting ways to do this. 16:32.700 --> 16:34.500 First, locating targets. 16:34.500 --> 16:36.620 Some quick ways to locate targets. 16:36.860 --> 16:38.360 Lots of stuff in there. 16:38.360 --> 16:42.920 Your eyes are probably all drawn to the last one, which, yes, it does say scraping turds. 16:44.560 --> 16:47.740 I don't know where the turds and the poo and all that stuff is coming from. 16:47.740 --> 16:51.360 It really is not a statement about me personally, it's just how it came out. 16:51.540 --> 16:53.020 Okay, that was a bad way to say that. 16:54.660 --> 16:55.860 All right, you get the idea. 16:56.020 --> 16:59.100 All right, very simple query, site colon microsoft.com. 16:59.100 --> 17:04.100 Again, we're having a nice little conversation with Google, trying to do recon on microsoft.com. 17:04.260 --> 17:08.440 Site microsoft.com lists every Google page from microsoft.com. 17:08.440 --> 17:09.860 All right, pretty straightforward. 17:09.980 --> 17:11.660 Problem is, the results suck. 17:11.660 --> 17:15.320 If you're trying to acquire targets, the targets are rather limited. 17:15.320 --> 17:20.280 Top of the list is www.microsoft.com, which the entire freaking planet knows exists. 17:20.320 --> 17:27.340 As an attacker, we don't care about www.microsoft.com, so bottom line is, we want to get rid of it. 17:27.340 --> 17:28.780 So we change our query. 17:28.900 --> 17:33.400 Site microsoft.com minus site screensaver.microsoft.com. 17:35.080 --> 17:41.700 Okay, and as you can see, when this query comes back, we're not looking at www's anymore, we're getting interesting target names. 17:41.820 --> 17:47.360 So an attacker sort of scrapes these target names to the side and, you know, collects them. 17:47.360 --> 17:48.920 Gets to be a little bit tedious. 17:49.160 --> 17:55.640 This isn't a great way to do it, because you run into a query cap of 32 search items in a query. 17:55.760 --> 18:01.980 So you keep reducing sites from this list, eventually you're going to run into into a limit, but you're getting interesting results. 18:01.980 --> 18:05.920 Research.microsoft.com, partner.microsoft.com, blah blah blah. 18:06.260 --> 18:08.080 All right, some other ways to do it. 18:08.080 --> 18:09.580 Back to regular expressions. 18:09.900 --> 18:22.580 Perform the query in an automated fashion, slamming all the results of the html into a big file, and use regular expressions to go through that file to look for urls that end in microsoft.com. 18:22.580 --> 18:29.160 Okay, so you're still using google to do the actual query, but you're not necessarily limited by google's search functionality. 18:29.280 --> 18:31.340 Okay, you can look for more interesting stuff. 18:31.540 --> 18:42.100 Okay, now you can not only do this with the search result page itself, but you can do this with the entire html content of the website as well, without throwing a single packet to the target. 18:42.220 --> 18:43.780 We'll talk about that next. 18:45.220 --> 18:46.500 All right, blah blah blah. 18:46.500 --> 18:48.240 You run the thing, you get stuff. 18:48.420 --> 18:50.240 A big so what slide here. 18:50.240 --> 18:52.960 Yeah, I know there's other ways to actually recon targets. 18:52.960 --> 18:57.100 The hook here is actually doing recon on the targets without sending packets to it. 18:57.100 --> 18:58.600 So that's where we're going to go. 18:58.720 --> 19:00.540 Now that you've read all that, next slide. 19:01.560 --> 19:03.440 All right, automated crawling. 19:03.440 --> 19:04.980 Google frowns on it. 19:04.980 --> 19:09.500 So we could use some other techniques to actually get things done. 19:09.500 --> 19:13.900 I think I'm probably going to skip all of this because... blah blah. 19:13.900 --> 19:15.260 I do want to highlight this. 19:15.260 --> 19:17.320 This is a nice tool again by SensePost. 19:17.320 --> 19:18.880 And you can download this stuff. 19:18.880 --> 19:21.900 Biddyblah is a very powerful tool. 19:21.900 --> 19:24.420 I encourage you to go to SensePost's site and check it out. 19:24.420 --> 19:37.460 But if you're not necessarily interested in all the functionality of Biddyblah, but you're more interested in the techniques that Biddyblah uses to actually map out a network, and you want to expand on that, some of these tools are available from SensePost as well. 19:37.460 --> 19:47.020 Bottom line, run this Perl script with a domain name, comes back and gives you a list of subdomains, DNS names and target names using Google queries. 19:47.020 --> 19:48.280 Pretty straightforward. 19:49.400 --> 19:50.060 Okay. 19:50.060 --> 19:51.860 On to the turd thing. 19:52.740 --> 19:57.600 I came up with another term, Google turds, which Google hasn't adopted yet either. 19:58.360 --> 20:03.720 I think it's because turds are usually brown and Google doesn't use brown in any of their color schemes. 20:04.060 --> 20:05.880 Not to be too graphic about it. 20:05.880 --> 20:09.180 But a Google turd is a Google query that's broken. 20:09.340 --> 20:11.020 It shouldn't return results. 20:11.020 --> 20:13.060 It's syntactically incorrect. 20:13.060 --> 20:15.280 Can anybody tell me what's wrong with this query? 20:15.280 --> 20:16.800 Site colon NASA. 20:19.220 --> 20:20.560 There's no .gov. 20:20.560 --> 20:20.840 Right. 20:20.840 --> 20:22.020 It's a busted query. 20:22.020 --> 20:23.640 Problem is, we got results. 20:23.640 --> 20:25.580 That's the heart and soul of a Google turd. 20:25.580 --> 20:27.540 Busted query that gets results. 20:27.640 --> 20:29.600 These results could be interesting. 20:29.680 --> 20:31.620 We could do something with these results. 20:31.620 --> 20:33.760 Lots of ways that these could have shown up. 20:34.440 --> 20:37.580 Syntax problems on the site when it was crawled, yada, yada, yada. 20:37.580 --> 20:39.860 But we'll come back to this in a little bit. 20:40.820 --> 20:41.640 All right. 20:42.440 --> 20:47.840 Also, there's a lot to be gotten from relationships between sites that you can actually use with Google. 20:47.840 --> 20:49.480 I'm going to go really light on this, too. 20:49.480 --> 21:03.380 But the bottom line is, if you can scrape all of this stuff from Google and get information about Microsoft.com, how much interest do you have in finding other sites other than Microsoft.com that could potentially be targets that are owned by the same entity? 21:03.720 --> 21:05.840 It's something you probably want to do. 21:05.940 --> 21:11.340 Well, in order to figure out relationships between sites, we need to have somewhat of a process. 21:11.340 --> 21:18.660 For example, if I post a link on my site to Microsoft.com, does that mean that there's a relationship between Microsoft and me? 21:20.020 --> 21:20.860 No. 21:20.880 --> 21:23.580 Anybody can throw up a link to Microsoft.com. 21:23.620 --> 21:25.340 Now, let's ask it another way. 21:25.340 --> 21:30.860 If Microsoft also has a link to me, is there possibly a relationship now? 21:31.480 --> 21:32.240 Possibly. 21:32.240 --> 21:34.200 In fact, it's fairly likely. 21:34.200 --> 21:36.580 This is the heart and soul of link weighting. 21:37.060 --> 21:40.960 Weighing links to and from sites to determine possible relationships. 21:41.040 --> 21:45.720 The bottom line here is that the two-way link weighs more than a one -way link. 21:45.720 --> 21:51.220 And you can use all of this information when you're scraping all this data from Google to figure out relationships. 21:51.840 --> 21:54.160 I just said that. 21:54.960 --> 21:58.700 Now, the question is, what can we use to determine links to and from a target? 21:58.780 --> 22:02.460 The answer for everything in this talk is Google, the link operator. 22:03.200 --> 22:08.680 Link www.microsoft.com shows all the sites that link to Microsoft's website. 22:08.840 --> 22:11.040 The problem is the results. 22:11.120 --> 22:13.840 For example, MapQuest, second in the list. 22:13.840 --> 22:16.520 Microsoft have anything to do with MapQuest? 22:17.480 --> 22:19.240 I hope not, do they? 22:20.260 --> 22:21.100 I don't know. 22:21.100 --> 22:24.400 Well, bottom line is the results are pretty bad. 22:24.780 --> 22:30.060 Also, link doesn't play well with other operators, so link is very limited for these purposes. 22:30.320 --> 22:35.160 If you try to use link and site together, the query is busted. 22:35.160 --> 22:36.220 It doesn't work. 22:36.880 --> 22:39.880 So, blah, blah, blah. 22:40.420 --> 22:41.980 Again, SensePost to the rescue. 22:41.980 --> 22:49.900 They have all sorts of tools that do stuff like this, and I'm really giving them a lot of press, because they deserve it. 22:50.040 --> 23:01.740 They've taken a lot of these really cool ideas with Google, and they haven't done DEF CON and Black Hat talks on them necessarily, but they've quietly implemented them into various tools that make sense. 23:01.740 --> 23:05.320 One of the tools is Bile, the bi-directional link extractor. 23:05.340 --> 23:08.960 Basically, Bile automates the process of figuring out link weights. 23:08.960 --> 23:10.280 Let me give you an example. 23:11.580 --> 23:13.900 For example, who is SensePost? 23:14.040 --> 23:16.540 You guys probably know, but let's pretend we don't. 23:16.540 --> 23:30.720 A Google query doesn't give you much of an answer, but if we throw SensePost.com into Bile, we find out that there are lots of links to SensePost.com from lots of different servers, and here's where they are. 23:31.800 --> 23:39.320 We also go through, and Bile will link weight each of those relationships to figure out which is the strongest, and this is the output that you get. 23:39.320 --> 23:41.480 You'll notice SensePost.com is at the top. 23:41.480 --> 23:45.460 It's the most strongly related site to SensePost that's out there. 23:45.460 --> 23:49.940 The second is BlackHat.com, and these are sorted order. 23:49.940 --> 23:53.380 Then we've got PacketStorm Security, SecurityLab.ru. 23:53.380 --> 23:59.660 Bottom line is, you can tell pretty quickly that SensePost has something to do with security, and they're involved in the security community. 23:59.660 --> 24:01.380 It's all done with Google queries. 24:01.380 --> 24:03.100 Google queries and link weighting. 24:04.140 --> 24:04.880 All right. 24:04.880 --> 24:05.900 Interesting question. 24:05.900 --> 24:09.940 Can Google be used to locate hosts that Google doesn't even know about? 24:10.660 --> 24:12.380 Sort of a brain teaser. 24:13.920 --> 24:14.960 Sure. 24:15.780 --> 24:18.160 But we'll need to do some background stuff first. 24:18.240 --> 24:19.300 Skipping that. 24:19.300 --> 24:19.940 All right. 24:20.020 --> 24:22.300 So we're at the point where we've located some targets. 24:22.300 --> 24:24.140 We've seen some interesting ways to locate targets. 24:24.140 --> 24:25.680 How about expanding the target list? 24:25.680 --> 24:28.160 Here's some ways that you can expand target lists. 24:28.300 --> 24:30.480 We'll talk about just a couple of them. 24:31.280 --> 24:37.280 If you've got a list of hosts, if you've got a domain, foo.com, you could brute force the domain with NSLookups. 24:37.720 --> 24:40.020 You could use every known word in a word list. 24:40.020 --> 24:42.520 You could do all sorts of interrelationship stuff. 24:42.560 --> 24:44.620 But that stuff doesn't always work. 24:44.820 --> 24:45.800 You could do fuzzing. 24:45.800 --> 24:53.620 For example, if I churn up BHST03.Verizon.com, I could fuzz that and see if BHST02 is there. 24:53.620 --> 24:56.380 Same with something like www33. 24:56.380 --> 24:59.700 It's basic fuzzing to help us expand our host list. 24:59.840 --> 25:00.460 Okay. 25:00.460 --> 25:01.680 You can also do it with names. 25:01.680 --> 25:03.120 Let's say we get these two hosts. 25:03.120 --> 25:05.820 Apple.foo.com and orange.foo.com. 25:05.820 --> 25:08.920 Can anybody give me some other hosts that might exist? 25:09.560 --> 25:11.720 Mango is the first answer. 25:12.020 --> 25:13.060 Slick. 25:14.900 --> 25:16.700 Caliente is not a fruit, is it? 25:17.200 --> 25:18.360 Passion fruit. 25:18.760 --> 25:20.580 You were at Black Hat, weren't you? 25:20.720 --> 25:23.180 That was the number one answer was passion fruit. 25:23.700 --> 25:27.180 It's much more passionate than the ones I came up with, but there you go. 25:27.260 --> 25:27.900 Cherry. 25:27.900 --> 25:29.100 I came up with mango. 25:30.040 --> 25:30.520 Watermelon. 25:30.520 --> 25:30.920 Pear. 25:30.920 --> 25:31.360 Strawberry. 25:31.360 --> 25:31.720 Banana. 25:31.720 --> 25:33.240 Didn't come up with passion fruit. 25:33.360 --> 25:33.900 All right. 25:33.900 --> 25:40.340 So you've done some, you know, basic expansion, some really basic fuzzing to figure out more targets that might be out there. 25:40.560 --> 25:40.900 All right. 25:40.900 --> 25:43.400 Let's figure out a more interesting way to do it. 25:43.400 --> 25:45.540 Anybody here use Google Sets? 25:46.560 --> 25:47.720 Okay, good. 25:47.800 --> 25:56.160 Google Sets actually takes a couple words, okay, that are related and tells you the next words in the series that might appear using Google's database. 25:56.600 --> 26:02.780 So for example, apples and oranges fired into Google Sets gives you a list that looks like this. 26:03.380 --> 26:12.360 We've got stuff like, we got here, we got pears and strawberries and blueberries and figs and kiwis. 26:12.360 --> 26:13.680 It's a pretty good list. 26:13.840 --> 26:14.440 Okay. 26:14.620 --> 26:18.420 Could fairly easily expand these, but let's try another exercise. 26:18.940 --> 26:21.940 We've got investor and foundation as host names. 26:21.940 --> 26:23.200 Expand those. 26:26.200 --> 26:28.680 Okay, I'll cut to the chase because there's not a lot of answers coming. 26:29.000 --> 26:29.920 It's tough. 26:29.920 --> 26:33.700 So let's throw it into Google Sets and see what Google Sets has to come up with. 26:33.700 --> 26:45.220 Investor and foundation thrown into Google Sets gives us this awesome list of things like the word board members and business directory and metal roof. 26:47.000 --> 26:51.180 And owner occupied at what Foga Fopa. 26:52.080 --> 26:53.140 Man, you guys are dumb. 26:53.140 --> 26:54.980 You didn't come up with any of these. 26:56.280 --> 27:01.560 Well, the problem is Google Sets did its best. 27:01.740 --> 27:05.260 The bottom line is here, we didn't give it related terms. 27:05.280 --> 27:10.820 So the next question I pose to you is, armed with a list of words, we're thinking host names here, right? 27:10.820 --> 27:13.680 How can we find the ones that are the most related? 27:13.960 --> 27:17.500 The answer for everything in this talk is thank you. 27:18.380 --> 27:19.120 All right. 27:19.340 --> 27:20.900 Here's one way to do it. 27:20.900 --> 27:25.000 Take the host names, every host name that you have, and split them up into unique pairs. 27:25.000 --> 27:28.400 For example, apple, pickle, orange, and Fred are host names. 27:28.400 --> 27:30.100 Break them up into unique pairs. 27:30.100 --> 27:32.880 Apple, pickle, apple, orange, apple, Fred, blah, blah, blah. 27:32.920 --> 27:38.100 And now we Google for each pair to get something that looks like this. 27:38.520 --> 27:38.840 Okay. 27:38.840 --> 27:45.400 Based on the Google results, which of these somewhat related host names are the most closely related? 27:47.720 --> 27:48.800 Apple and orange. 27:48.800 --> 27:50.380 It has the most hits. 27:50.380 --> 27:51.980 It's a reasonable assumption. 27:52.000 --> 27:59.040 So you get a massive host list, feed it into unique pairs through Google queries, and get Google to tell you which ones are the most closely related. 27:59.040 --> 28:06.040 And then you throw those two into Google sets, or you automate this process, like we have on the bottom left, to get the same results. 28:06.040 --> 28:08.180 Bottom line, apple and orange wins. 28:08.180 --> 28:11.300 Google figured out which of the words was most closely related. 28:11.360 --> 28:13.480 So let's pull it together. 28:15.580 --> 28:17.460 I'll pull it together with pictures. 28:18.200 --> 28:18.840 All right. 28:18.840 --> 28:20.220 We get a list of targets. 28:20.220 --> 28:21.780 Here's sdsu.edu. 28:21.780 --> 28:23.040 List of targets. 28:23.140 --> 28:28.020 Physics, music, bio, geology. 28:28.020 --> 28:30.060 Okay, they're college courses, right? 28:30.120 --> 28:37.940 So let's feed, and this is automated here, let's feed all of these words into Google to come up with the two that are the most closely related. 28:37.940 --> 28:42.800 And we find out that chemistry and physics are, in fact, the two mostly closely related words. 28:43.040 --> 28:54.280 What we do next is feed chemistry and physics into Google sets to get a list of expanded host names to figure out, and then stick them on to sdsu.edu. 28:54.780 --> 28:59.120 And what we're gonna do is send a single NS lookup to figure out if these hosts resolve. 28:59.180 --> 29:00.600 Again, all automated. 29:00.920 --> 29:03.560 And as you see, a lot of the hosts resolved. 29:03.760 --> 29:04.860 Okay, pretty nice. 29:05.180 --> 29:11.160 So we can also go in, we can do links to see if they have, you know, if they're web servers, you can do port scanning, whatever. 29:11.240 --> 29:19.540 Now, the only reason I'm checking to see if these are web servers is because of this very chic and and very hard to read table. 29:20.240 --> 29:24.400 Now, the table is interesting, because it basically sums up what we found. 29:24.400 --> 29:27.420 13 new hosts that we didn't have before. 29:27.700 --> 29:33.580 Okay, we found 13 new hosts using this method, seven of which Google knew nothing about. 29:34.040 --> 29:36.400 Google couldn't find any of these hosts. 29:36.840 --> 29:39.380 Four of those hosts were web servers. 29:39.460 --> 29:41.740 So Google didn't even know about these web servers. 29:41.740 --> 29:47.680 So the answer to the question is, can you use Google to find hosts that Google doesn't even know about is yes. 29:47.680 --> 29:48.400 Thank you. 29:48.640 --> 29:49.380 All right. 29:49.660 --> 29:50.920 Blah, blah, blah. 29:52.000 --> 29:52.760 Verifying. 29:52.820 --> 29:55.560 I get a little bit into verifying. 29:55.580 --> 30:01.420 Bottom line is you can use lots of stuff to verify the targets, but we're gonna try to do it in a more stealthy fashion. 30:02.000 --> 30:02.880 One more example. 30:02.880 --> 30:04.940 Remember the NASA sites, all right? 30:05.040 --> 30:07.040 What was missing from the end of them? 30:07.720 --> 30:08.440 .gov. 30:08.440 --> 30:11.060 74 results in this Google turd query. 30:11.100 --> 30:15.980 If I slap .gov onto the end of each of these hosts, how many of them do you think resolve? 30:16.920 --> 30:18.100 All of them. 30:18.900 --> 30:25.140 Okay, the bottom line is these were posted to the web, they were broken, we fixed them, we resolved them, we found targets. 30:25.220 --> 30:30.520 Okay, point is lots of ways to get interesting host information without sending any packets to the target. 30:31.280 --> 30:32.040 All right. 30:32.120 --> 30:34.220 All right, now about zero packet scanning. 30:34.220 --> 30:36.660 This is sort of meant as a joke. 30:38.280 --> 30:41.180 Zero packet scanning does not mean passive. 30:41.180 --> 30:43.320 Okay, I'm not talking about passive here. 30:43.320 --> 30:48.660 I'm not talking, I'm talking about zero packets from you, the source, to your target. 30:48.660 --> 30:55.300 So let's try to figure out some ways that we can actually do some recon without sending any packets directly to the target. 30:55.640 --> 30:58.840 It's about having fun with Google, remember when security was fun? 30:58.880 --> 31:02.060 Okay, so please no comments about the zero packet thing. 31:02.280 --> 31:03.080 All right. 31:03.320 --> 31:08.200 For example, DNS resolution isn't a big deal. 31:08.840 --> 31:12.880 Okay, port scanning is, that flags IDS monitor, so we don't want to do that crap. 31:13.160 --> 31:16.140 So let's find some interesting ways to get Google to help us out. 31:16.140 --> 31:20.200 Here you go, one Google query that finds forms that look like this. 31:20.420 --> 31:26.460 This form lets you send an email to somebody from somebody with a subject and a body and it comes from their web server. 31:26.640 --> 31:30.480 You do one Google query, you find this form, you fire off email from them. 31:31.200 --> 31:32.180 Isn't this fun? 31:32.860 --> 31:37.040 One Google query, find sites that'll gladly run the finger command for you. 31:37.520 --> 31:40.880 Notice I said that without opening myself to any finger jokes. 31:42.680 --> 31:46.440 One Google query, find sites that will actually ping for you. 31:47.120 --> 31:51.860 One Google query that will find sites that will gladly port scan a target for you. 31:53.080 --> 31:54.940 Zero packets from you to the target. 31:54.940 --> 31:59.980 You proxy your connection through this site, they're doing the port scanning, plus you're coming in proxy. 32:00.580 --> 32:01.400 Fun. 32:02.080 --> 32:02.960 How about this one? 32:02.960 --> 32:05.100 This one's a little long-winded, so I'm going to blow through it. 32:05.100 --> 32:08.000 Another site that lets you do port scanning, limited ports. 32:08.000 --> 32:09.500 See the limited ports? 32:09.660 --> 32:13.380 Here we go with more 1984 eliteness. 32:13.660 --> 32:17.620 What do you think the colon 81 on the end of that URL refers to? 32:18.260 --> 32:19.360 A port. 32:19.360 --> 32:23.200 And what do you suppose that little red dot that says port closed means? 32:24.420 --> 32:25.620 Port closed. 32:25.620 --> 32:31.680 So let's change the URL to 80 and we get a green dot which means port open. 32:32.020 --> 32:45.500 So we write a little script that actually fires through all those URLs to see which image is returned and we have an automated solution that actually bounces a port scan off of another site, zero packets from you to the target, you get your port scan at their expense. 32:45.760 --> 32:54.920 For example, you can even build an HTML page on your local workstation that looks like this if you really must have green and red dots to break into a site. 32:55.940 --> 32:57.640 Some of you do and that's okay. 32:59.380 --> 33:02.420 How about one Google query to find open proxy servers? 33:02.440 --> 33:07.740 Okay, when you run out of proxy servers to bounce all this crap off of, fire off a Google query and find some more. 33:08.340 --> 33:10.460 Open reverse squid proxies. 33:10.580 --> 33:14.360 Another CGI proxy, one query to find CGI proxies. 33:14.700 --> 33:16.440 Okay, this one's kind of fun. 33:16.440 --> 33:25.720 Please choose URL slash encoding and then they give you a little box and you put a URL in there and what do you know it bounces you to a site proxy style. 33:25.720 --> 33:29.680 Here I am viewing my website through a Chinese government proxy. 33:31.580 --> 33:32.900 Oh, did I say Chinese? 33:32.900 --> 33:36.340 I meant I was thinking about Chinese food and it just came out. 33:37.100 --> 33:39.280 Next slide, not the food, but the word. 33:39.920 --> 33:42.860 All right, here's one Google query that actually does all this stuff for you. 33:42.860 --> 33:44.080 Sites that'll do all this crap. 33:44.080 --> 33:48.120 Trace route, who is, fingers, NS lookup, hosts, DNS queries, digs. 33:48.120 --> 33:51.160 Again, one Google query, this site will do your bidding. 33:51.820 --> 33:54.340 Okay, this one will find NQT. 33:54.340 --> 33:55.880 I covered NQT last year. 33:55.880 --> 33:58.120 It's got some interesting limited functionality. 33:58.360 --> 34:09.700 But bottom line here is Jimmy Neutron actually turned this into a nice little Perl script to bounce scans off of an NQT server so that you can do all this stuff off of NQT. 34:09.700 --> 34:13.440 These tools are available from my website if you want to take a look at those. 34:14.020 --> 34:15.020 Okay, I'm skipping this one. 34:15.020 --> 34:17.420 This is basically a Java SSH client. 34:17.800 --> 34:21.560 You can do all sorts of nasty stuff with this, but it's from your machine. 34:21.580 --> 34:22.800 It's just kind of neat. 34:22.800 --> 34:24.360 So skip that. 34:24.740 --> 34:26.280 Oh, wait, come back. 34:27.000 --> 34:30.560 Is there a way to anonymously web crawl a target without pounding it with packets? 34:30.560 --> 34:31.360 Of course. 34:32.360 --> 34:34.620 How many of you have ever used a cache link? 34:35.160 --> 34:36.460 Keep your hands up. 34:37.020 --> 34:40.940 How many of you have ever read the banner at the top of the cache page? 34:42.300 --> 34:43.100 Good. 34:43.160 --> 34:45.880 I got to say the average is better than it was at Black Hat. 34:46.120 --> 34:46.880 All right. 34:46.880 --> 34:52.740 Now, for those of you that haven't read this page, shame on you, but let's figure out what happens when you click on a cache link. 34:52.800 --> 34:54.960 All right, here's a TCP dump. 34:54.960 --> 34:56.200 We click on a cache link. 34:56.200 --> 34:59.940 We make a connection to, in this case, the Frack website and to Google. 35:00.260 --> 35:02.220 Okay, so got some stuff going on. 35:02.220 --> 35:05.780 Question is, what was that that happened behind the scenes? 35:05.780 --> 35:06.760 What is this? 35:07.320 --> 35:08.220 It's an image. 35:08.480 --> 35:15.680 Okay, so up in the little header, Google was kind enough to tell you this cache page may reference images which are no longer available. 35:15.680 --> 35:18.080 Click here for the cache text only. 35:18.200 --> 35:20.940 So let's click here for the cache text only. 35:20.940 --> 35:21.980 Sniff it again. 35:21.980 --> 35:25.500 This time the entire conversation is between me and Google. 35:25.780 --> 35:31.440 We got the HTML off the site safely from Google without touching the Frack website. 35:31.440 --> 35:36.880 Bottom line here is it's very easy to get HTML content without sending any packets to the target. 35:36.880 --> 35:39.880 What you do with that content is wide open. 35:39.880 --> 35:41.600 Run regular expressions through it. 35:41.600 --> 35:42.520 Do whatever you want. 35:42.520 --> 35:44.940 Bottom line is you're not touching the target. 35:44.940 --> 35:46.160 You're talking to Google. 35:47.820 --> 35:50.240 Question is, what happened behind the scenes? 35:50.240 --> 35:52.020 Top URL is the cache link. 35:52.020 --> 35:54.260 Bottom URL is the cache text only. 35:54.260 --> 35:55.680 There's only one difference. 35:55.680 --> 35:58.080 It's got and strip equals one on the end. 35:58.180 --> 36:01.400 Okay, so let's see how we would do this in the real world. 36:01.400 --> 36:03.160 Right click on a cache link. 36:03.300 --> 36:05.400 Save the address to the clipboard. 36:05.400 --> 36:07.160 Paste it up to the address bar. 36:07.160 --> 36:09.740 Slap and strip equals one onto the end. 36:09.740 --> 36:13.880 And you're viewing the HTML of the web page without sending any packets to the target. 36:13.880 --> 36:14.860 Easy, right? 36:15.360 --> 36:16.400 No, it's not. 36:16.400 --> 36:18.180 You're supposed to say no, it's not. 36:18.180 --> 36:23.460 Okay, well, how about a Firefox plug-in that actually does this for you? 36:25.680 --> 36:31.740 All right, right click on any URL on any page and you get these nifty little options. 36:31.740 --> 36:33.820 Passive cache Google this link. 36:33.820 --> 36:35.620 What do you think that does? 36:36.280 --> 36:41.540 Okay, very nice plug-in written by Brian Baskins available from our website. 36:42.100 --> 36:43.120 Not from Google. 36:43.120 --> 36:44.100 I'll say Google. 36:44.520 --> 36:49.140 All right, so you right click on the link and it takes you to the passive cache Google image of that page. 36:49.140 --> 36:50.720 You don't have to hit the target. 36:50.860 --> 36:52.840 The one under that is nice too. 36:52.840 --> 36:54.740 Passive cache archive this link. 36:54.740 --> 36:58.460 How about pulling the page out of archive.org to see what it looked like in the past? 36:58.640 --> 37:02.920 Okay, so two very nice options for getting web pages without touching the target. 37:02.940 --> 37:04.160 Right, Firefox. 37:04.540 --> 37:07.940 So yes, you can do zero packet recon against the target. 37:08.340 --> 37:11.600 And we're flying, we're not letting you read, we're going on. 37:13.400 --> 37:14.560 Yeah, I'll talk about this. 37:14.560 --> 37:15.220 This is kind of neat. 37:15.220 --> 37:19.000 I didn't necessarily invent this thing, but it's it's kind of a neat situation. 37:19.300 --> 37:22.900 Let's say you go to a web page that you find in Google and it's down. 37:22.900 --> 37:26.240 You click the cache link and sometimes the cache link's even broken. 37:26.400 --> 37:28.060 Sometimes you get that error message. 37:28.180 --> 37:34.740 Well, the question is, is there any way we can recreate that web page without, you know, without hurting ourselves? 37:34.740 --> 37:36.660 And the answer is cache sliding. 37:36.660 --> 37:41.120 Somebody else came up with this and with all my Google skills I couldn't for the life of me figure out who it was. 37:41.120 --> 37:47.200 So if you know, please tell me so you don't think I'm making this up as my own uber eliteness stuff. 37:47.240 --> 37:48.980 All right, so we have this query. 37:48.980 --> 37:51.620 We can rebuild the web page just from the snippet. 37:51.620 --> 37:53.460 The way you do it is pretty straightforward. 37:53.680 --> 38:03.360 What you do is you find the page that you're looking for, you narrow down the page with a query, and you actually throw words from the snippet on the tail end of your query. 38:03.660 --> 38:05.440 Okay, it's pretty straightforward. 38:05.440 --> 38:11.840 But what you do is you keep sliding your search queries forward so that you can read more and more of the snippet. 38:11.840 --> 38:17.320 So for example, you can see I queried for natives project next to each other, right? 38:17.320 --> 38:20.440 The next query I query for album entitled. 38:20.660 --> 38:23.860 Notice it's showing me before and after my search term. 38:23.860 --> 38:28.100 I'm recreating the web page without the web page even being there. 38:28.100 --> 38:29.440 The cache is gone. 38:29.440 --> 38:30.880 The real web page is gone. 38:30.880 --> 38:35.520 Bottom line is you keep sliding it forward and forward until you recreate the entire web page. 38:35.680 --> 38:37.200 All right, neat stuff. 38:38.080 --> 38:41.740 Just a quick second about this user agent spoofing. 38:43.520 --> 38:47.940 It's entirely possible for you to change your user agent to make your browser look different. 38:47.940 --> 38:51.320 How many of you have ever changed your user agent to Googlebot? 38:51.380 --> 38:52.420 Excellent. 38:52.420 --> 38:54.760 Nobody at Black Hat raised their hands. 38:55.140 --> 38:56.560 That's pretty cool. 38:56.580 --> 39:00.560 Well, surfing the net as Googlebot has some interesting ramifications. 39:00.560 --> 39:08.600 For one, lots of badly configured sites like forums and news sites actually lock people out depending on what their user agent is. 39:08.600 --> 39:11.880 For example, you got this advertising on your site, right? 39:11.880 --> 39:19.420 You want Google to see your advertising and all that garbage and be able to troll through your forum so that it can send visitors your way, all right? 39:19.420 --> 39:22.140 But you want users to actually sign up for an account. 39:22.140 --> 39:26.560 So you block anybody that comes in that doesn't have Googlebot as their user agent. 39:26.580 --> 39:34.180 So if you want to view the site, set your user agent to Googlebot and you traipse right into the site as the Googlebot and get whatever you want. 39:34.280 --> 39:37.200 Now, these people ain't too bright. 39:38.120 --> 39:39.240 I'll be the first to admit it. 39:39.240 --> 39:41.680 This is not security, okay? 39:41.680 --> 39:43.640 I don't think it was meant to be. 39:43.660 --> 39:52.260 And a lot of sites do this cloaking a better way, which is you look at the user agent plus you look at the IP they came from, see if it came from Google. 39:52.300 --> 39:53.820 That's a better way to do it. 39:53.840 --> 39:56.920 But bottom line is you can have an awful lot of fun with this. 39:57.660 --> 40:00.020 All right, the fireworks show. 40:01.300 --> 40:04.660 Welcome to the Google Hacking Showcase 2005. 40:04.840 --> 40:07.480 All you people that are sleeping, wake up now. 40:08.340 --> 40:09.420 There you go. 40:11.080 --> 40:14.080 Let the games begin, the best and worst of this year. 40:14.360 --> 40:16.500 All right, let's start pretty easy. 40:16.500 --> 40:18.040 How about VNC servers? 40:18.040 --> 40:20.260 How many of you have used VNC or know what it is? 40:20.420 --> 40:21.040 Yeah. 40:21.620 --> 40:27.660 You install it on your server, you install a client, you point it at your server, you control the keyboard and the mouse. 40:27.660 --> 40:28.580 It's pretty nice. 40:28.580 --> 40:33.180 It requires a username, it requires a password, it requires you to know the port that it's listening on. 40:33.200 --> 40:46.820 All right, how about one query that finds real VNC servers that will actually send you down a Java-based client that you can use and is also nice enough to fill in the hostname and the port that you should connect to, right? 40:47.020 --> 40:50.080 And one modification to the query, and guess what? 40:50.080 --> 40:53.800 You can find sites that have no username or password associated with them. 40:53.860 --> 40:56.640 One Google query, you're moving the keyboard and the mouse. 40:57.100 --> 41:01.060 Anybody that has doubts about it being called Google Hacking, just go. 41:01.880 --> 41:03.260 All right, thank you. 41:03.440 --> 41:04.440 All right, this one's weak. 41:04.440 --> 41:06.580 Next, print servers. 41:06.740 --> 41:08.000 Dang, got it. 41:08.260 --> 41:10.180 My laptop even thought it was weak. 41:11.740 --> 41:15.680 All right, one query that actually finds access print servers. 41:15.680 --> 41:24.440 Now, print servers are boring little beasts, you know, unless you're FX and those folks that do really ungodly things to printers. 41:24.660 --> 41:26.620 But printers get a really bad rap. 41:26.620 --> 41:29.680 Now, I'm going to show you some more Oday here. 41:30.200 --> 41:32.440 This is really elite stuff. 41:32.440 --> 41:34.080 Press, you should start writing right now. 41:34.140 --> 41:35.580 Five minutes? 41:35.780 --> 41:37.960 All right, let's fly. 41:37.960 --> 41:45.780 All right, the zero day here is you actually click on that little oval right there with your thing that's a mouse, right? 41:45.780 --> 41:53.960 You click the left button with your finger and you aim it at that little oval that says configuration wizard and what do you think happens? 41:54.740 --> 41:56.280 It orders Chinese. 41:56.280 --> 41:57.320 No, not really. 41:57.360 --> 41:59.440 You enter configuration management. 41:59.440 --> 42:01.140 How about webcams? 42:01.140 --> 42:02.780 I hate freaking webcams. 42:02.780 --> 42:05.360 These webcams, however, are really interesting. 42:05.360 --> 42:07.440 This gives shoulder surfing a new name. 42:09.080 --> 42:16.460 This one's nice because it's pointing at big barrels of explosive looking things and it has a laser button there. 42:16.580 --> 42:18.420 All right, so you can shoot the things. 42:21.160 --> 42:24.840 I'm pretty sure that's what, I didn't click it, but all right. 42:24.840 --> 42:27.980 Anyway, this is the inside of a tactical nuclear submarine. 42:28.540 --> 42:29.580 No, not really. 42:30.540 --> 42:32.280 But it's like eBay or something. 42:32.280 --> 42:33.020 I don't know. 42:33.020 --> 42:34.080 Very interesting. 42:34.620 --> 42:35.720 How about this one? 42:35.720 --> 42:37.680 A speed stream DSL router. 42:37.780 --> 42:39.020 Very nice. 42:39.020 --> 42:41.200 Again, here we go with the uber hacker tricks. 42:41.200 --> 42:43.440 Please do not print this in the press. 42:43.440 --> 42:47.860 What you do is you take the mouse, left button again, and you click on that oval. 42:47.860 --> 42:50.540 It says disconnect. 42:54.810 --> 42:56.490 Yeah, what do you think happens? 42:56.930 --> 42:58.470 Yeah, bye-bye. 42:58.470 --> 42:59.270 All right, how about this one? 42:59.270 --> 43:00.130 A Belkin router. 43:00.130 --> 43:02.730 One query finds Belkin routers that are misconfigured. 43:02.730 --> 43:06.010 You can lock them out of their own wireless network for their own safety. 43:15.700 --> 43:16.780 All right, how about this one? 43:16.780 --> 43:19.620 Who can guess the system password on this box? 43:26.210 --> 43:31.470 Yeah, that's bad news. 43:31.650 --> 43:34.090 This is a query that finds a Windows small business server. 43:34.090 --> 43:35.970 Attention, this site is for employee use. 43:35.970 --> 43:38.830 Only public access to our website can be found by clicking here. 43:38.830 --> 43:41.970 So you're supposed to, you know, be there and not here. 43:41.970 --> 43:42.770 But anyway. 43:43.350 --> 43:43.790 All right. 43:43.790 --> 43:44.610 Boring. 43:44.610 --> 43:45.030 Next. 43:45.030 --> 43:46.130 Pivot software. 43:46.130 --> 43:51.410 This one, this Google query lets you find pages that let you set up the administrator user. 43:52.470 --> 43:57.350 And again, left button, little oval, proceed to log in, create an admin account. 43:57.350 --> 43:58.230 Got it. 43:58.410 --> 43:59.050 Boring. 43:59.050 --> 43:59.470 Next. 43:59.470 --> 44:00.270 Printers. 44:00.290 --> 44:03.710 The printers suck unless you can see the print jobs that they're actually printing. 44:03.750 --> 44:04.470 How about these? 44:04.470 --> 44:05.890 Microsoft Word documents. 44:05.890 --> 44:08.950 Some have to do with religion, some have to do with aphrodisiacs. 44:08.950 --> 44:10.970 Problem was it was the same user. 44:12.650 --> 44:13.930 Not sure. 44:13.930 --> 44:16.310 This is like a distributed denial of service. 44:16.310 --> 44:18.990 You find a printer that lets you do all this stuff to it. 44:18.990 --> 44:23.410 You turn on NetWare and AppleTalk at the same time. 44:25.210 --> 44:27.170 It's just, it's just evil. 44:27.370 --> 44:29.590 One query to find firewalls . 44:29.590 --> 44:32.370 How about smoothwall and IP cops that need updating? 44:32.990 --> 44:35.210 Snort IDS front ends. 44:35.210 --> 44:37.650 How many of you know about that Cisco problem? 44:39.570 --> 44:43.070 Yeah, it's, there's a lot of technical stuff into how that works. 44:43.070 --> 44:48.950 You can probably do something similar with a query like this to just find open Cisco devices for people that are stupid. 44:49.650 --> 44:51.090 Open switches. 44:51.330 --> 44:51.850 Yep. 44:51.970 --> 44:53.930 PHP nuke is very nice. 44:53.930 --> 44:55.030 How about this one? 44:55.030 --> 44:57.570 A query that finds PHP nuke sites. 44:57.570 --> 44:59.550 There are no administrator accounts yet. 44:59.550 --> 45:02.910 Proceed to create them by clicking here. 45:04.010 --> 45:08.370 Yeah, for security reasons it is best that you create the super user right now by clicking here. 45:12.280 --> 45:13.800 Parking lot Nazi cam. 45:13.800 --> 45:19.140 This is so you can see the CIO vault over his convertible when he comes into the building from the handicapped parking spot. 45:19.400 --> 45:21.040 Okay, more security cameras. 45:21.040 --> 45:23.700 Multiple camera views including one called Woody. 45:24.880 --> 45:25.680 I didn't click. 45:25.680 --> 45:26.680 I didn't click. 45:27.440 --> 45:29.520 Time-lapse video recorders. 45:30.120 --> 45:31.740 That's not the end of my presentation. 45:31.740 --> 45:34.660 You guys knew I was out of time so you went right to the end of my presentation. 45:34.960 --> 45:36.620 All right, we are very close to the end. 45:36.740 --> 45:38.200 Sorry for the next person. 45:38.740 --> 45:39.660 Very sorry. 45:40.980 --> 45:41.840 Going back. 45:41.840 --> 45:43.080 We're going back. 45:49.100 --> 45:50.280 Okay, let's go to the... 45:54.870 --> 45:56.070 Ah, here we go. 45:56.230 --> 45:57.550 Sorry, it will be worth the wait. 45:57.550 --> 46:00.130 There we go. 46:00.630 --> 46:02.830 All right, I won't press the wrong button again. 46:02.870 --> 46:04.030 One query that lets you find... 46:05.330 --> 46:08.710 I don't know what this is, but I think that stands for master bedroom. 46:09.730 --> 46:10.670 How about this one? 46:10.670 --> 46:21.770 One query that lets you find e-power switches, web-controlled sockets in somebody's house, electrical sockets, Google for the default password, and you get these rectangular buttons, which it's sort of like crypto. 46:24.670 --> 46:28.990 You click the rectangle in this case that says power and restart. 46:30.070 --> 46:31.690 Yeah, all right. 46:31.690 --> 46:32.570 How about this one? 46:32.570 --> 46:37.070 Lots more things to turn off, including things like on and off buttons. 46:37.070 --> 46:38.430 These are ovals, easy to find. 46:38.430 --> 46:40.910 Turn off lamps and motion detectors. 46:41.290 --> 46:46.330 You can even turn off their media rack, their aquarium, and their electric bong. 46:46.890 --> 46:47.470 How 46:53.930 --> 46:56.470 about this one? 46:56.470 --> 46:59.950 One click to turn off somebody's Christmas lights. 47:00.410 --> 47:02.350 It's just rude. 47:02.550 --> 47:03.910 Usernames and passwords. 47:03.910 --> 47:21.110 How about digital camera image dumps from cell phones, Sprint, T-Mobile, Counter-Strike server configs with clear text passwords, MSN contact lists, how about vCalendar files, MSN ccMail mailbox files, open SQL servers, no username or password required, 47:21.110 --> 47:23.210 point and click, own the database. 47:23.850 --> 47:25.450 SQLite, same deal. 47:25.450 --> 47:29.170 Netscape history files, including clear text pop passwords. 47:29.230 --> 47:33.110 And the surfing list, which includes IBM and hotchicks.com. 47:34.470 --> 47:35.910 How about this one? 47:35.910 --> 47:43.210 These are sysprep.in files that actually show the clear text admin password and the product ID for Windows that they use to install it. 47:43.650 --> 47:45.310 All right, that's a good one. 47:45.730 --> 47:46.430 Yeah. 47:46.430 --> 47:50.850 How about IPSec final encryption keys? 47:50.910 --> 47:52.850 VPN user profiles. 47:52.850 --> 47:55.430 Now, VPN is very secure, so these are encrypted. 47:55.430 --> 47:58.390 Unfortunately, though, these are not. 48:00.050 --> 48:02.570 How about Nessus scan output? 48:02.570 --> 48:06.310 Explorer windows, yes, that does say WinNT system 32. 48:06.310 --> 48:09.670 And yes, the oval does read delete. 48:16.600 --> 48:22.720 All right, police reports, sensitive government documents, yes, sensitive government documents are on the web. 48:22.880 --> 48:26.720 How about this one for the FOUO raincoat? 48:27.100 --> 48:29.580 The FOUO ensemble? 48:29.900 --> 48:34.880 The step-by-step instructions for putting on the coat, which should be classified, I think. 48:35.000 --> 48:37.500 And whatever the hell this guy's doing. 48:39.260 --> 48:43.140 I don't know what he's doing, but he's probably smiling, and that's rated a 10. 48:43.140 --> 48:44.060 Yeah. 48:45.600 --> 48:48.280 Government research project, this is Boba Fett. 48:48.880 --> 48:50.840 The Silence of the Lambs guy. 48:51.740 --> 48:55.640 Darth Vader with the drinking attachment. 48:57.040 --> 49:02.620 If Darth Vader's at DEF CON, and he wants to drink, he shouldn't have to show his ugly head now, should he? 49:02.840 --> 49:05.000 All right, so yeah, we got all sorts of stuff. 49:05.000 --> 49:05.640 How about this one? 49:05.840 --> 49:07.320 Authorized user only. 49:07.320 --> 49:09.520 I'm at the end of the presentation again. 49:09.540 --> 49:11.920 Yes, it did say authorized user only. 49:11.920 --> 49:14.180 Do not distribute, do not put on web. 49:14.180 --> 49:17.360 I am completely out of time, but let's do our last two slides here. 49:18.380 --> 49:24.500 For a shirt, can anyone guess what this username and password should be to break in here? 49:28.840 --> 49:29.660 All right. 49:29.660 --> 49:30.420 Very good. 49:30.420 --> 49:30.980 Next one. 49:30.980 --> 49:32.380 Next one's a little bit easier. 49:32.380 --> 49:32.720 How about... 49:35.040 --> 49:36.860 how about... there we go. 49:38.200 --> 49:39.640 Sorry, I'm out of time, guys. 49:39.740 --> 49:40.280 All right. 49:41.420 --> 49:42.300 Yes. 49:42.400 --> 49:44.340 How do you break into this site, folks? 49:44.340 --> 49:47.100 It says admin equals false in the URL. 49:48.680 --> 49:53.560 Yeah, let's change it to admin equals true, and congratulations, you now have access.