55 Ways To Have Fun With Google (2006)

33. Google Ads Gone Wrong

Oh, eBay has everything too!2

Syphilitic singles3... hmm, there has to be a bigger fish out there...

This is a “performance art” ad by Christophe Bruno (see Chapter 17).

111

55 Ways to Have Fun With Google

Of course there’s a discount. The pet is dead after all.

Google ads can be a one-stop life help center4. First, they aid you on cheating; then, they help your partner find out about it; and finally, they tell you how to cope with it once that happens!

112

33. Google Ads Gone Wrong

What’s that...?

This might come in handy when Superman’s around.

End Notes

1.Xcom 2002. (xcom2002.com/doh/)

2.Colleen Kane. (www.55fun.com/33.2)

3.Harlow. (acsu.buffalo.edu/~harlow/)

4.BrainWise. (brainwise.org)

5.Zman Biur. (biurchametz.blogspot.com)

6.Matt’s Mac Journal. (friends.macjournals.com/mattd/)

113

55 Ways to Have Fun With Google

34. Life in the Age of Google

114

34. Life in the Age of Google

115

55 Ways to Have Fun With Google

116

34. Life in the Age of Google

117

55 Ways to Have Fun With Google

35. Google Hacking

Yes, I am a criminal. My crime is that of curiosity.

– Mentor, The Hacker Manifesto

There’s a sport called “Google Hacking” which is all about searching for seemingly private websites using Google. In fact, you can only find public websites using Google, because private (password-protected) pages can’t be found by Google – so it’s no real hacking (let alone “cracking,” which would consist of deleting, changing or abusing the found data). But it’s fun nevertheless, and often enables people to discover pages someone was hoping for to stay private. This happens when the site is misconfigured, i.e. when the webmaster doesn’t know enough about how to set up a website.

Here are some of the most popular and powerful “Google hack” search queries. Enter them at your own risk, and know that every once in a while you step onto a so-called honeypot (a fake website set up to lure hackers into it, with the goal of finding out more about them and their tactics).

Finding Error Messages

Search for: “A syntax error has occurred” filetype:ihtml

You’ll find: Pages which caused errors the last time Google checked them. This may hint at vulnerabilities or other unwanted side-effects.

How this works: The first phrase simply looks for an error the target server itself did once output. The “filetype” operator on the other hand restricts the result pages to only those which have the “ihtml” extension (which are sites using Informix). A related search is “Warning: mysql_query()”.

Finding Seemingly Private Files

Search for: (password | passcode) (username | userid | user) filetype:csv

You’ll find: Files containing user names and similar.

How this works: The “filetype” operator makes sure only “Comma Separated Values” files will be returned. Those are not typical web pages, but data files. “(password | passcode)” tells Google the file must

118

35. Google Hacking

contain either the text “password” or “passcode,” or both (the “|” character means “or”). Also, result pages are restricted to those containing either of the words “username,” “userid” or “user.”

Finding File Listings

Search for: intitle:index-of last-modified private

You’ll find: Pages which list files found on the server.

How this works: The “intitle” operator used above will ensure that the target page contains the words “Index of” in the title. This is typical for those open directories which list files (they will have a title like “Index of /private/foo/bar”). “Last modified” on the other hand is a column header often used on those pages. And the word “private” makes sure we’ll find something of interest. A related search query which finds FTP (File Transfer Protocol) information is intitle:index.of ws_ftp.ini

Finding Webcams

Search for: “powered by webcamXP” “Pro|Broadcast”

You’ll find: Public webcams set up by people to film a location, or themselves.

How this works: “Powered by WebcamXP” is a text found on specific kinds of webcam pages. A related search query to find cameras is inurl:“ViewerFrame?Mode=”.

Finding Weak Servers

Search for: intitle:“the page cannot be found” inetmgr

You’ll find: Potentially weak (IIS4) servers.

How this works: An old Microsoft Internet Information server may hint at security issues. This is one of many approaches that can be used to find such a weak server.

Finding Chat Logs

Search for: something “has quit” “has joined” filetype:txt

You’ll find: Chat log files showing what people talked about in a chat room.

How this works: Though the files found are all public, not everyone chatting on IRC (the Internet Relay Chat) is aware of potential logging

119

55 Ways to Have Fun With Google

mechanisms. The “filetype” operator makes sure only text files are found, and “has quit”/ “has joined” are automated messages appearing in chat rooms. This search is your chance to tune into people’s chatter. Note you should replace “something” with the thing you are looking for.

120