Google (http://www.google.com), can give lots of info to a hacker, to download files etc. The reason is because google has lots of options on its search engine. Google search options. Filetype: We can search for specific files ex. *.xls, *.doc, *.pdf, *.ps, *.ppt, *.rtf, *.db, *.mdb, *.cfg, *.pwd, *.dat , etc. usage ex.: Filetype:xls "pass" Inurl: We can specify a word, and it will return us all urls which contains the word - usage ex.: inurl:admin "Index of": We can find directory listings of specific folders on servers-usage ex.: "index of" admin or index.of.admin Site: We can find specific sites (domain names) ex. *.com, *.org, *.mi, *.gov, etc. - usage ex.: site:gov Intitle: We can find specific urls with a specific title - usage ex.: intitle:library Link: Allows us to check which site links to a specific site - usage ex.: link http://www.blogurself.com Hacking and stealing info. By combining these options, we can get lots of infos and to steal files etc. Lets see some examples and howto. Try searching for: * inurl:gov filetype:xls "restricted" (will return all goverment sites with excel files with the name "restricted") * inurl:admin.cfg (admin.cfg, most of times is an admin configuration file. It may be as admin.cfg or config.cfg or setup.cfg . These files contain sensitive informations). * Webadmin: This is a small software that many admins use for editing their sites and uploading files remotely. The main page for the webadmin control centre is called webeditor.php (more infos and to download at http://wacker-welt.de/webadmin/ ). So, we search for webeditor.php ex. inurl:webeditor.php (if the admin failed to protect these pages, we can gain full access). The upload file usally is file_upload.php, so we can directly search for this file ex. inurl:file_upload.php). * Content Manager Systems: Are softwares that allows the webmaster to edit, alter and control the content of his site. Those kind uses online control panels usually named cms.html, panel.html or control.cfg. Just use the inurl option. * Frontpage Server Extensions HTML Administration Forms: Users with access to these forms, are able to * perform a number of administrative functions remotely. The main page of these forms, is fpadmin.htm. When a default install is performed, the files are located in admin directory. So, we can search for ex. inurl:fpadmin.htm "index of" admin or inurl:admin/fpadmin.htm . HMTL Administration Forms are not active when first installed, so u might not be able to perform any administrative functions. Also try "# -FrontPage-" inurl:service.pwd * Freesco Router: Is a software for linux which, by default, installs a web browser, which allows owners to control the router through the http protocol. The default password and login for this control panel is admin * and admin . Lots of people dont know this, so we search ex. intitle:"freesco control panel"or"intitle:check the connection". * intitle:"Index of" passwords modified * allinurl:auth_user_file.txt * "access denied for user" "using password" * "A syntax error has occurred" filetype:ihtml * allinurl: admin mdb * "ORA-00921: unexpected end of SQL command" * inurlasslist.txt * "Index of /backup" * "Chatologica MetaSearch" "stack tracking:" * "parent directory " /appz/ -xxx -html -htm -php -shtml -op * "parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory " Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * inurl:microsoft filetype:iso You can change the string to watever you want, ex. microsoft to adobe, iso to zip etc. * "AutoCreate=TRUE password=*" This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. For those who can read Japanese, check out the author's site at: http://www.coara.or.jp/%7Epassy/"]http://www.coara.or.jp/~passy/ * http://www.google.com/search?hl=en&lr=&ie=UTF-8&c2coff=1&q="http://*:*@www"+domainname This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the the domain name without the .com or .net * Another way is by just typing http://www.google.com/search?hl=en&lr=&ie=UTF-8&c2coff=1&q="http://George:George@www" * "sets mode: +k" This search reveals channel keys (passwords) on IRC as revealed from IRC chat logs. * allinurl: admin mdb Not all of these pages are administrator's access databases containing usernames passwords and other sensitive information, but many are! * allinurl:auth_user_file.txt DCForum's password file. This file gives a list of (crackable) passwords, usernames and email addresses for DCForum and for DCShop (a shopping cart program. * intitle:"Index of" config.php This search brings up sites with "config.php" files. To skip the technical discussion, this configuration file * contains both a username and a password for an SQL database. Most sites with forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN access to the database. * eggdrop filetype:user user These are eggdrop config files. Avoiding a full-blown descussion about eggdrops and IRC bots, suffice it to say that this file contains usernames and passwords for IRC users. * intitle:index.of.etc This search gets you access to the etc directory, where many many many types of password files can be found. This link is not as reliable, but crawling etc directories can be really fun! * filetype:bak inurl:"htaccess|passwd|shadow|htusers" This will search for backup files (*.bak) created by some editors or even by the administrator himself (before activating a new version). Every attacker knows that changing the extenstion of a file on a webserver can have ugly consequences. * Let's pretend you need a serial number. T o find the serial for Adobe Photoshop - "Adobe Photoshop" 94FBR * ?intitle:index.of? mp3 You only need add the name of the song/artist/singer. Example: ?intitle:index.of? mp3 eminem General notes. 1. Try searching for strings in different languages. 2. Learn more about different softwares that webmasters use, find important files and search for. 3. U can find different vulnerabilities (ex. by taking the list of a vulnerabilitie scanner or by checking the net) and combine them with ur strings or to get new ideas for strings to search for. EDITED: I edited alot out (Dont want to get banned), these are just some basic google commands. I just thought this guide would be useful for webmasters so they can help protect there own sites. Enjoy, Nick
if people want i can post the full guide i made? i just dont want to get banned :S EDIT: PUT UP FULL GUIDE
Then you obviously dont know how to use the commands properly, If you know what to seach for and how to use what you have found, you can absolutely destory sites. Not that i condone this in anyway.
And if I give you my FTP password, you can absolutely "destroy" my site...what the hell is your point. You didn't even come up with these ideas, you compiled a list from another site.
Haha even better, you stole this whole article from here: http://www.undergroundsystems.org/forums/showthread.php?t=2443 Content the ifs = lowest scum of the internet. Failure.
yeah like they said it's not hacking, just a list of command how to use google more effctiveness and might use google search inthe bad ways. but most gov sites wont put the important file in the place that you can download easy.
If you can't write your own material and are forced to steal others and claim it as your own...than there is no hope for you at all.
theres no hope for either if an argument over the DP forums really is how you wish to express yourselves on the internet
Nothing more childish than copying and pasting someone's article on to your blog and submitting it to digg claiming it's yours.