ECA
08-05-2005, 05:28 PM
http://news.yahoo.com/news?tmpl=story&cid=1093&ncid=1093&e=4&u=/pcworld/20050802/tc_pcworld/122066
Getting In Via Google
Although security software can identify when an attacker is performing reconnaissance work on a company's network, attackers can find network topology information on Google instead of snooping for it on the network they're studying, he said. This makes it harder for the network's administrators to block the attacker. "The target does not see us crawling their sites and getting information," he said.
Often, this kind of information comes in the form of apparently nonsensical information--something that Long calls "Google Turds." For example, because there is no such thing as a Web site with the URL "nasa," a Google search for the query "site:nasa" should turn up zero results. Instead, it turns up what appears to be a list of servers, offering an insight into the structure of the U.S. National Aeronautics and Space Administration's internal network, Long said.
Combining well-structured Google queries with text processing tools can yield things like SQL passwords and even SQL error information. This could then be used to structure what is known as a SQL injection attack, which can be used to run unauthorized commands on a SQL database. "This is where it becomes Google hacking," he said. "You can do a SQL injection, or you can do a Google query and find the same thing."
theres lots more on the site.......
Getting In Via Google
Although security software can identify when an attacker is performing reconnaissance work on a company's network, attackers can find network topology information on Google instead of snooping for it on the network they're studying, he said. This makes it harder for the network's administrators to block the attacker. "The target does not see us crawling their sites and getting information," he said.
Often, this kind of information comes in the form of apparently nonsensical information--something that Long calls "Google Turds." For example, because there is no such thing as a Web site with the URL "nasa," a Google search for the query "site:nasa" should turn up zero results. Instead, it turns up what appears to be a list of servers, offering an insight into the structure of the U.S. National Aeronautics and Space Administration's internal network, Long said.
Combining well-structured Google queries with text processing tools can yield things like SQL passwords and even SQL error information. This could then be used to structure what is known as a SQL injection attack, which can be used to run unauthorized commands on a SQL database. "This is where it becomes Google hacking," he said. "You can do a SQL injection, or you can do a Google query and find the same thing."
theres lots more on the site.......