Can credit card numbers really be found on Google by searching for the phrase Visa 4356000000000000 4356999999999999?
The answer is yes, if databases of purchase records, which include card numbers, are either stolen and placed online, or are initially stored in a public place.
Google hacking first made the headlines in 2004. Today, with numerous how-to books on the subject, just about anyone can learn about it and apply the "trade".
In simple terms, Google hacking is the use of a search engine, such as Google, to locate security vulnerabilities - misconfigurations and software vulnerabilities - on companies` Web servers or servers accessible via the Internet.
By searching for default server page titles, for example, an attacker can find easily exploitable servers. Applications left in default modes can also be found by searching for error pages generated by the software. And searching for specific file names can pinpoint vulnerable servers connected to the Internet.
There`s also a database of queries that identify sensitive data, the Google Hacking Database (GHDB), available for all and sundry at http://johnny.ihackstuff.com.
Although Google blocks some of the better known Google hacking queries, nothing stops a hacker from crawling your site and launching the GHDB queries directly onto the crawled content.
At www.i-hacked.com, there`s even a sample of interesting searches that can be sent to Google to obtain info that some people might not want anyone to have. For example: "access denied for user"; "using password"; "A syntax error has occurred"; "allinurl: admin mdb"; "ORA-00921: unexpected end of SQL command"; "inurl:passlist.txt", and so on.
Try it. Type the phrase "access denied for user" and "using password" into Google. Some 103 000 Web pages will be returned, some volunteering their SQL error messages. Among these will also be Web sites that give harmless information such as user IDs, SQL server stats and configuration details.
The easiest way to check whether a Web site and applications have Google hacking vulnerabilities is to use a Web vulnerability scanner. A Web vulnerability scanner scans the entire Web site and automatically checks for pages that are identified by Google Hacking queries.
Of course, the best safeguard is not to publish information others shouldn`t see - because people will find it, because search engines are doing their jobs and because hackers are developing even more sophisticated methods to exploit search engine vulnerabilities - giving them access to personal and sensitive information.
Share