Stumbled upon Google Hacks yesterday. Some are fun, some are useful and some stray into script kiddie territory. Anyway, here’s a rundown.

Fun:
inurl “viewerframe?mode=refresh”: should allow you to check insecure networked webcams. Doesn’t seem to work anymore – probably Google caught on and somehow filters that search.

Interesting:
“intitle:index of” : searching web content for files you want to have, for instance “intitle:index of” killers mp3

Mh, err:
“robots.txt” “disallow:” filetype:txt : find a listing of the text files for which it was explicitely specified not to be listed by search engines. The example given is the white house.
intitle:index of ws_ftp ini : hm. Allows you to pick up some config files from ws_ftp, which seems to have some weaknesses.
intitle:”index of” passwd passwd.bak : the guy goes wrong there, because i haven’t seen a whole lot of plaintext passwords lying around – usually it’s the ‘x’ that goes for password is hashed in shadow file . Fortunately.
inurl:_vti_pvt “service.pwd” : hack sites made with Frontpage. Apparently the pass is encrypted with DES, not that safe.
“vnc desktop” inurl: : you probably get the picture. The password is apparently easy to crack, too.
intext:”UAA (MSB)” Lexmark -ext:pdf or inurl:”port_255″ -htm : web interface of some networked printers are freely available. Room for practical jokes or a little bit of spying.
intitle:”index of” cookies.txt : cookie files lying about. You still need to crack the hashes or to be into exploiting other people’s sessions. What you certainly can see is what people are into (XXX for instance).
intitle “usage statistics for” “generated by webalizer” : lets you see webalizer pages from slightly underprotected servers. Like traffic over time.
intitle:phpMyAdmin “Welcome to phpMyAdmin ***” “running on * as root@*” : yes, for some it actually works.

Well, there’s a dark side to every technology : a powerful search engine can pick holes in your security, especially if there isn’t any. You think you’re safe, protected by the sheer mass of information, but no longer.

Still, it’s interesting to know about commands like intitle, intext, inurl.

• Previous Entry: Cold Turkey
• Next Entry: Cash machine