With Google hacking you can find important files inside websites, pages that should be
secret, list of emails, lists of passwords, upped shells, database backups, and various
other things that Google indexes.
Google has several features that make the hacker's life easier.
So I always say when they ask me something obvious:
Learn to use Google, it's your friend!
(When I say "something obvious," I mean some information that can easily be acquired with
a simple Google search.)
Well, one of these features that Google offers is the use of Dorks.
Dorks are parameters that are passed in the search so that Google better interprets what
you want and shows the results according to the search.
Want a practical example of this?
Let's type the following command in Google.
Did you notice anything different?
All sites listed have the same parameter, in the URL.
This is because you told Google to only list the sites that contain this parameter in the
URL.
This dork I've passed can be modified to find flaws in websites.
A very common failure is SQL Injection, where you inject a command into the site database
to return the user list and password.
And this command is done through the URL of the site.
With this dork you can find sites that may be vulnerable to SQLi, because the id that
is in the URL is used in a query in the database, so if you change that id to any command, it
will be executed by the database.
Here are some examples of dorks: This List every page that contains the name
is welcome in the title of the site.
Lists all pages that contain the index.swf file on the site.
Lists all pages that contain the word "password" in the body.
List only txt files on any website.
You can combine the dorks to do a more specific search, for example:
It will list the .sql files containing "PHPMyAdmin SQL Dump" in the content.
In this case, dumps of entire databases will be displayed, and you may have some interesting
content in it.
This lists the .txt files that have an at sign followed by "yahoo", "hotmail" or "gmail".
That is, it returns mailing lists.
And those are just a few examples of dorks, if you have interest, look for Google Dorks
on Google will find sites like db exploit, which has a huge amount of dorks to exploit
vulnerabilities in websites and servers.
After these explanation videos that I have recently posted, I think some network-related
questions have come up.
Let's clarify some of them in the next video, where I'll explain the main protocols used.
So guys this was the video, I hope you liked it, leave your like and sign up, thanks, he
said.
Không có nhận xét nào:
Đăng nhận xét