USA 2004

### Overview In this talk, a penetration tester demonstrates how search engines—specifically Google—serve as passive, stealthy information gathering tools during penetration tests and malicious attacks. The speaker emphasizes that information gathering is the critical initial stage of an engagement. Because search engines rely on the persistent "memory of the net" (such as cached pages, newsgroups, and sites like archive.org), attackers can extract detailed intelligence about an organization's architecture, systems, and personnel without sending a single network packet to the target.

### Key Topics - **Passive Reconnaissance**: Utilizing search engine caches and historical web archives to map target infrastructure invisibly over extended periods. - **Search Syntax & Advanced Operators**: Leveraging targeted characters (`""`, `.`, `+`, `-`) and directives (`site:`, `filetype:`, `inurl:`, `intitle:`, `intext:`, `cache:`, `link:`, `related:`, `phonebook:`, `define:`) to isolate high-value data. - **Sensitive Data & Credential Discovery**: Finding publicly exposed configuration files, log files, database error messages, and network scans. - **Social Engineering Amplification**: Extracting personal details, employee changes, and newsgroup postings to craft targeted phishing or Trojan delivery attacks. - **Defensive Countermeasures**: Hardening servers, performing defensive Google auditing, utilizing honeypots/honeytokens, and initiating removal requests through Google.

### Technical Details - **Target Identification**: Web servers (e.g., Apache, IIS) can be fingerprinted via cached example pages or default errors. Outgoing HTTP/FTP proxies can be identified via leaked web log traces, and internal/external mail routing details can be discovered in newsgroup message SMTP headers. - **Offline Site Browsing**: Queries combining `site:foo.com` and site-specific keywords allow Google to function like an offline browser or a stealth CGI scanner, exposing page counts and cached content without target interaction. - **Exposed Credentials and Files**: Specific queries such as `index of` can uncover exposed directory listings containing `htpasswd` or `.password` files. Search filters can target Excel files with columns for usernames, passwords, or emails, or uncover sensitive files like `config.php`, `wsftp.log`, `robots.txt`, `ipsec.conf`, `admin.mdb` (Access databases), FrontPage configuration files, or Windows system directories. - **Automated Tool Outputs and Error Messages**: Attackers can locate leaked tool reports, such as Nessus scans or David Litchfield's `ngscan` (which in one displayed example leaked credentials where the password matched the username). ODBC error disclosures reveal table names, SQL query fragments, database server names, and occasionally database passwords. In another cited case, an administrator troubleshooting an emergency on a newsgroup posted complete internal network architectures and IP addresses.

### Takeaways & Defensive Recommendations - **Regular Auditing & Hardening**: System administrators must patch and harden web servers, disable directory browsing, and routinely run Google searches against their own domains and personnel to audit exposed data. - **Google Removal Process**: Organizations should request data removal from Google's cache and index. The speaker notes this involves a verification process where Google requires the requester to host a specific web page to authenticate webmaster ownership, which typically takes one to two weeks. - **Active Deception**: Deploying web-based honeypots and honeytokens can attract attackers and penetration testers. Analyzing web logs for the incoming Google search referral queries helps organizations identify what queries attackers are using and adjust defenses accordingly. - **Resources**: The speaker references Johnny Long's work on Google hacks/dorks, the Athena toolset, and Google APIs for further exploration.