The Power of Google: A Hacker's Best Friend

Google is my favorite search engine. It's internal API has so many options its just nuts. Of course, we rarely use the real power of it, mostly because we are oblivious to it.

This morning I read a really good article on using google to do probes and gain access to files that you may otherwise not want. Wanna find all excel files that may be private, and put up on the wrong server by some sloppy sales guy? Try:

filtype:xls inurl:sales

Now comb through it. I found acouple of interesting spreadsheets that shouldn't be online.

Here is a thought that wasn't mentioned in the article, but has a SERIOUS impact on anyone configuring moveabletype, and does it incorrectly. If you were to do:

inurl:mt.cgi

every so often you will be bound to find someone who has installed it, but not yet configured it, giving you the ability to take over the site by using the default username of 'Melody' and the default password of 'Nelson'. Well, more to the point, you could use a specially crafted URL with that user/pass combo from the info from google and automate the whole thing.

I will leave the actual code to the imagination of the user, but I 'theoretically' got this down in a short perl script. It can extract the list from google, iterate through it and query every site with moveable type. Most mt.cgi entries on google actually come from usage stats thanks to webalizer. You can typically ignore these sites, because if they made it on the usage stats, chances are its in use. Want an example? Wanna know where Arc logs in to Moveable type for ufies.org?

site:ufies.org inurl:mt.cgi

It's right there for the pickings.

To be honest, this is kinda lame, because we all know that the mt.cgi will be around that location. But lets look at other implications. Bugtraq comes out with atleast one new vulnerable php script weekly. It would be nothing to put:

inurl:lame_php_script.php

and go to town exploiting the thing. Wanna hack a particular website? Use a perl script to iterate through a file of common vulnerable strings (which you could steal from Nessus or snort), combine it with the combo of inurl and site directives and go to town. I will leave it to the readers imagination just how far this can go.

Anyways, in case you didn't get it the first time, you really should read this article. A good read.