Watching the
Watchers
Target Exploitation via Public
Search Engines
mail://[email protected]
http://johnny.ihackstuff.com
what’s this about?
using search engines to do interesting
(sometimes unintended) stuff
sp3ak l1ke l33to hax0rs
act as transparent proxy servers
sneak past security
find development sites
what’s this about?
using search engines to find exploitable
targets on the web which
run certain operating systems
run certain web server software
harbor specific vulnerabilities
harbor sensitive data in public directories
harbor sensitive data in public files
automating the process: googlescan
pick your poison
we have certain needs from a search engine:
advanced search options (not just AND’s and OR’s)
browsing down or changed pages (caching)
instant response (zero-wait)
document and language translations
web, news, image and ftp searches
The obvious choice: Google
not new... Vincent GAILLOT
<
[email protected] lyon.fr> posted this to
BUGTRAQ nearly two
years ago...
doing interesting stuff
hax0r, “Google hacks,” proxy, auth
bypass, finding development sites
hax0r
for those of us
spending way
too much time
spe@king
hax0r...
/misc: “Google Hacks”
There is this book.
And it’s an O’REILLY book.
But it’s not about hacking.
It’s about searching.
I didn’t write it.
Because if I wrote it, it would really be about hacking
using Google and that would get both Google and
O’REILLY both really upset and then lawyers would get
involved, which is never good unless of course the lawyer
happens to be Jennifer Granick... =)
proxy
Google offers a
very nice
language
translation
service.
proxy
for example,
translating from
english to
spanish...
proxy
Our english-to-spanish translated Google page is:
http://translate.google.com/translate (main URL)
?u=http://www.defcon.org&langpair=en|es (options)
What happens if we play with the options a bit to provide an
english-to-english translation, for example?
http://translate.google.com/translate (main URL)
?u=http://www.defcon.org&langpair=en|en (options)
proxy
we’re surfing
through Google,
not to the evil
DEFCON page.
The boss will be
sooo proud! 8P
proxy
Google proxy bouncers
http://exploit.wox.org/tools/googleproxy.html
http://johnny.ihackstuff.com
finding development sites
use unique phrases from
an existing site to find
mirrors or development
servers hosting the same
page.
this is a copy of a
production site found on
a web development
company’s server...
finding development sites
• troll the development site with another search looking
for more files on that server...
finding development sites
• eventually, creative searching can lead to pay dirt: a source code dump
auth bypass
Let’s say an attacker is interested in
what’s behind www.thin-ice.com, a
password protected page:
auth bypass
One search gives us insight into the
structure of the site:
auth bypass
Another search gives a cache link:
auth bypass
Another click takes us to the cached version of
the page (no password needed!)
auth bypass
One more click to the really interesting
stuff... site source code!
*this site was notified and secured before making this public. sorry, kids ;-)
evil searching: the
basics
tools of the trade
Google search syntax
Tossing Google around requires a firm
grasp of the basics.
Many of the details can be found here:
http://www.google.com/apis/reference.html
simple word search
A simple search...
simple word search
...can return amazing results. This is the contents of a
live .bash_history file!
simple word search
Crawling around on the same web site reveals a
firewall configuration file complete with a username and
password...
simple word search
...as well as an ssh known hosts file!
simple phrase search
Creativity with search phrases (note the use of quotes)…
simple phrase search
...can reveal interesting tidbits like
this Cold Fusion error message.
simple phrase search
(Error messages
can be very
revealing. )
simple phrase search II
Sometimes the most idiotic searches
(“enter UNIX command”)...
simple phrase search II
...can be the most rewarding!
special characters
symbol use
+ (plus) AND, force use
- (dash) NOT (when used outside
quotes)
. (period) any character
- (dash) space (when used in
quotes)
* (asterisk) wildcard word (when used
in quotes)
site: site-specific search
site:gov boobs
site: crawling
site:defcon.org defcon
-use the site: keyword
along with the site name
for a quick list of
potential servers and
directories
site: crawling
-use the site: keyword
along with a common file
extension to find
accidental directory
listings..
Date Searching
• If you want to limit your results to documents that
were published within a specific date range, then
you can use the “daterange: “ query term to
accomplish this. The “daterange:” query term
must be in the following format:
• daterange:<start_date>-<end date> where
• Date Restricted • Star Wars daterange:2452122-
• <start_date> = Julian date indicating the start of
Search 2452234
the date range
<end_date> = Julian date indicating the end of
the date range
• The Julian date is calculated by the number of
days since January 1, 4713 BC. For example, the
Julian date for August 1, 2001 is 2452122.
Title searching
If you prepend "intitle:" to a query term,
Google search restricts the results to
documents containing that word in the
title. Note there can be no space between
Title Search (term) intitle:Google search
the "intitle:" and the following word.
Note: Putting "intitle:" in front of every word
in your query is equivalent to putting
"allintitle:" at the front of your query.
Starting a query with the term "allintitle:"
Title Search (all) allintitle: Google search restricts the results to those with all of the
query words in the title.
INURL: URL Searches
inurl: find the search term within the URL
inurl:admin
inurl:admin
users mbox
inurl:admin users
passwords
filetype:
filetype:xls “checking
account” “credit card”
many more examples
coming... patience...
finding interesting stuff
finding OS and web server versions
Windows-based default server
intitle:"Welcome to Windows 2000 Internet Services"
Windows-based default server
intitle:"Under construction" "does not currently have"
Windows NT 4.0
intitle:“Welcome to IIS 4.0"
OpenBSD/Apache (scalp=)
“powered by Apache” “powered by openbsd"
Apache 1.2.6
Intitle:”Test Page for Apache” “It Worked!”
Apache 1.3.0 – 1.3.9
Intitle:”Test Page for Apache” “It worked!” “this web site!”
Apache 1.3.11 - 1.3.26
"seeing this instead" intitle:"Test Page for Apache"
Apache 2.0
Intitle:”Simple page for Apache” “Apache Hook Functions”
Directory Info Gathering
• Some servers, like Apache, generate a server version tag...
Apache Version Info
•Apache •Number
Version of Servers
• 119,00
• 1.3.6 0.00
• 151,00
• 1.3.3 0.00
• 159,00
• 1.3.14 0.00
• 171,00
• 1.3.24 0.00
• 203,00
• 1.3.9 0.00
• 256,00
• 2.0.39 0.00
• 259,00
• 1.3.23 0.00
• 260,00
• 1.3.19 0.00
• 300,00
• 1.3.12 0.00
...which we can harvest for some quick stats...
• 353,00
Weird Apache Versions
Esoteric Apache Versions found on Google
query: intitle:"Index of" "Apache/[ver] Server at"
Number of Servers
80000 69 ,30 0
6 4,2 00 65 ,00 0
70000 60 ,50 0 62 ,90 0
60000 45,200
50000
40000
27,300
30000
20000 9,4 00
10000 33 30 24 5 310 5 207 93 74 61 3 9 20 2 1,130 4 74
1,120
739
0
1.3.26+interserver
1.3.xx
1.3.23-dev
1.3.24-dev
1.3.15-dev
1.3.21-dev
2.0.37-dev
2.0.40-dev
1.3.4-dev
1.3.7-dev
1.2.6
1.3.17-HOF
1.3.11
2.0.28
2.0.32
2.0.35
2.0.36
1.3.17
1.3b6
1.3.0
1.3.1
1.3.2
1.3.4
2.0.16
2.0.18
Apa che Ve rsio n
Common Apache Versions
Common Apache Versions found on Google
query: intitle:"Index of" "Apache/[ver] Server at"
1,000,000.00 896,000
Number of Servers
800,000.00
600,000.00 495,000
353,000
400,000.00 300,000
260,000 259,000 256,000
159,000 171,000 151,000 203,000
200,000.00 119,000
0.00
1.3.6
1.3.9
1.3.12
1.3.14
1.3.20
1.3.22
1.3.23
1.3.24
1.3.3
1.3.19
1.3.26
2.0.39
Apache Server Version
vulnerability trolling
finding 0day targets...
vulnerability trolling
A new vulnerability hits the streets...
vulnerability trolling
The vulnerability lies in a cgi script called “normal_html.cgi”
vulnerability trolling
212 sites are
found with the
vulnerable CGI
the day the exploit
is released.
more interesting stuff...
finding sensitive data in directories
and files
Directory Listings
Directory listings are often misconfigurations in
the web server.
A directory listing shows a list of files in a
directory as opposed to presenting a web
page.
Directory listings can provide very useful
information.
Directory Example
a query of
intitle:”Index of”
reveals sites like
this one.
The “intitle”
keyword is one
of the most
powerful in the
google master’s
arsenal...
Directory Example
notice that the
directory listing
shows the
names of the
files in the
directory.
we can combine
our “intitle”
search with
another search
to find specific
files available on
the web.
Intitle:”Index of” .htpasswd
Lots more
examples
coming. Stick
around for the
grand finale...
finding interesting stuff
automation: googlescan
Googlescan
With a known set of file-based web
vulnerabilities, a vulnerability scanner
based on search engines is certainly a
reality.
Let’s take a look at a painfully simple
example using nothing more than UNIX
shell commands...
Googlescan.sh first, create a file
(vuln_files) with the
names of cgi
programs...
Googlescan.sh
...then, use this shell
rm temp script...
awk -F"/"
'{print $NF"|http://www.google.com/search?q=
intitle%3A%22Index+of%22+"$NF}' vuln_files > queries
for query in `cat queries`
do
echo -n $query"|" >> temp
echo $query | awk -F"|" '{print $2}'
lynx -source `echo $query | awk -F"|" '{print $2}'` |
grep "of about" |
awk -F "of about" '{print $2}' |
awk -F"." '{print $1}' |
tr -d "</b>[:cntrl:] " >> temp
echo " " >> temp
Done
cat temp |
awk -F"|" '{print "<A HREF=\"" $2 "\">" $1 " (" $3 "hits)
</A><BR><BR>"}' | grep -v "(1,770,000" > report.html
Googlescan.sh output
...to output an
html list of
potentially
vulnerable or
interesting web
servers
according to
Google.
http://johnny.ihackstuff.com/googledorks.shtml
more interesting stuff
Rise of the Robots
Rise of the Robots
“Rise of the Robots”, Phrack 57-10 by
Michal Zalewski: autonomous malicious
robots powered by public search engines
Search engine crawlers pick up malicious
links and follow them, actively exploiting
targets
Rise of the Robots: Example
Michal presents the following example links on his
indexed web page:
http://somehost/cgi-bin/script.pl?p1=../../../../attack
http://somehost/cgi-bin/script.pl?p1=;attack
http://somehost/cgi-bin/script.pl?p1=|attack
http://somehost/cgi-bin/script.pl?p1=`attack`
http://somehost/cgi-bin/script.pl?p1=$(attack)
http://somehost:54321/attack?`id`
http://somehost/AAAAAAAAAAAAAAAAAAAAA...
Rise of the Robots: Results
Within Michal’s study, the robots followed all
the links as written, including connecting to
non-http ports!
The robots followed the “attack links,”
performing the attack completely unawares.
Moral: Search engines can attack for you, and
store the results, all without an attacker
sending a single packet directly to the target.
Prevention
Locking it down
Google’s advice
This isn’t Google’s fault.
Google is very happy to remove
references. See
http://www.google.com/remove.html.
Follow the webmaster advice found at
http://www.google.com/webmasters/faq.h
tml.
My advice
Don’t be a dork. Keep it off the web!
Scan yourself.
Be proactive.
Watch googledorks
(http://johnny.ihackstuff.com/googledorks.shtml)
Finally....
The Grand Finale!
intitle:index.of test-cgi
intitle:index.of page.cfm
exploitable by
passing invalid
?page_id=
intitle:index.of dead.letter
intitle:index.of pwd.db
passwd –pam.conf
intitle:index.of master.passwd
intitle:index.of..etc passwd
intitle:index.of passwd
intitle:"Index.of..etc" passwd
intitle:"Index.of..etc" passwd
intitle:"Index.of..etc" passwd
intitle:index.of auth_user_file.txt
intitle:index.of pwd.db
passwd –pam.conf
intitle:index.of ws_ftp.ini
intitle:index.of
administrators.pwd
intitle:index.of people.lst
intitle:index.of passlist
intitle:index.of .htpasswd
intitle:index.of “.htpasswd” htpasswd.bak
intitle:index.of “.htpasswd” htpasswd.bak
intitle:index.of “.htpasswd” htpasswd.bak
intitle:index.of secring.pgp
intitle:index.of..etc hosts
intitle:index.of..etc hosts
intitle:Index.of etc shadow
intitle:index.of passlist
filetype:xls username password email
intitle:index.of config.php
social security numbers
how about a few
names and
SSN’s?
social security numbers II
How about a few
thousand
names and
SSN’s?
social security numbers III
How about a few
thousand more
names and
SSN’s?
Final words...
other google press..
“Mowse: Google Knowledge: Exposing Sensitive data with Google”
http://www.digivill.net/~mowse/code/mowse-googleknowledge.pdf
“Autism: Using google to hack”
www.smart-dev.com/texts/google.txt
“Google hacking”:
https://www.securedome.de/?a=actually%20report (German)
“Google: Net Hacker Tool du Jour”
http://www.wired.com/news/infostructure/0,1377,57897,00.html
EOF
<plug> Watch googleDorks. </plug>
Questions?
Contact Me / Get stuff:
http://johnny.ihackstuff.com
[email protected] Special Thanks to j3n, m@c, tr3 and p3@nut! =)
