www.syngress.com
Syngress is committed to publishing high-quality books for IT Professionals and deliv-
ering those books in media and formats that fit the demands of our customers. We are
also committed to extending the utility of the book you purchase via additional mate-
rials available from our Web site.
SOLUTIONS WEB SITE
To register your book, visit www.syngress.com/solutions. Once registered, you can access
our Web pages. There you may find an assortment of value-
added features such as free e-books related to the topic of this book, URLs of related
Web sites, FAQs from the book, corrections, and any updates from the author(s).
ULTIMATE CDs
Our Ultimate CD product line offers our readers budget-conscious compilations of some
of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect way to
extend your reference library on key topics pertaining to your area of expertise,
including Cisco Engineering, Microsoft Windows System Administration, CyberCrime
Investigation, Open Source Security, and Firewall Configuration, to name a few.
DOWNLOADABLE E-BOOKS
For readers who can’t wait for hard copy, we offer most of our titles in downloadable
Adobe PDF form. These e-books are often available weeks before hard copies, and are
priced affordably.
SYNGRESS OUTLET
Our outlet store at syngress.com features overstocked, out-of-print, or slightly hurt
books at significant savings.
SITE LICENSING
Syngress has a well-established program for site licensing our e-books onto servers in
corporations, educational institutions, and large organizations. Contact us at sales@syn-
gress.com for more information.
CUSTOM PUBLISHING
Many organizations welcome the ability to combine parts of multiple Syngress books, as
well as their own content, into a single volume for their own internal use. Contact us at

Burlington, MA 01803
Google Hacking for Penetration Testers, Volume 2
Copyright © 2008 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as permitted
under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by
any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with
the exception that the program listings may be entered, stored, and executed in a computer system, but they may
not be reproduced for publication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN 13: 978-1-59749-176-1
Publisher: Amorette Pedersen Page Layout and Art: Patricia Lupien
Acquisitions Editor: Andrew Williams Copy Editor: Judy Eby
Cover Designer: Michael Kavish Indexer: J. Edmund Rush
For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director and
Rights, at Syngress Publishing; email m.peder

452_Google_2e_FM.qxd 10/11/07 11:56 AM Page iv
Acknowledgments
v
There are many people to thank this time around, and I won’t get to them all. But I’ll
give it my best shot. First and foremost, thanks to God for the many blessings in my
life. Christ for the Living example, and the Spirit of God that encourages me to live
each day with real purpose.Thanks to my wife and three wonderful children. Words
can’t express how much you mean to me.Thanks for putting up with the “real”
j0hnny.
Thanks to the book team: CP, Seth Fogie, Jeffball55, L0om, pdp, Roelof Temmingh,
Rar, Zanthas.Thanks to my friends Nathan, Mike “Corn” Chaney, Seth Fogie, Arun,
@tlas and Apu.Thanks to my many confidants and supporters in the Shmoo group, the
ihackcharities volunteers and supporters, Malcolm Mead and Pat,The Predestined
(David, Em, Isaac, Josh, Steve, Vanessa),The Tushabe family, Dennis and all of the

hevensnt, yeseins & klouw, bsdman & klouw & mil, digital.ronin, harry-aac,
none90810, donjoe145, toxic-snipe, shadowsliv, golfo and klouw, MacUK / Klouw,
Carnage, pulverized, Demogorgo, guardian, golfo, macuk, klouw,, Cylos, nihil2006,
anonymous, murfie and rgod, D. Garcia, offset, average joe, sebastian, mikem, Andrew A.
Vladimirov, bullmoose, effexca, kammo, burhansk, cybercide cybercide, Meohaw, ponds,
blackasinc, mr.smoot, digital_revolution, freeeak, zawa, rolf, cykyc, golfo wolveso, sfd
wolveso, shellcoder, Jether, jochem, MacUK / df, tikbalang, mysteryman0122, irn-bru,
blue_matrix, dopefish, muts, filbert, adsl3000, FiNaLBeTa, draino, bARDO, Z!nCh &
vs1400, abinidi, klouw & murfie, wwooww, stonersavant, jimmyn, linuxinit, url, dragg,
pedro#, jon335, sfd cseven, russ, kg1, greenflame, vyom, EviL_Phreak, golfo, CP,
klouw,, rar murfie, Golem, rgod +murfie, Madness!, de Mephisteau, gEnTi, murfie &
wolveso, DxM, l0om wolveso, olviTar, digitus, stamhaney, serenh, NaAcces, Kai, good-
virus, barabas, fasullo, ghooli, digitalanimal, Ophidian, MacUK / CP / Jeffb,
NightHacker, BinaryGenius, Mindframe,TechStep, rgod +jeffball55 +cp, Fusion, Phil
Carmody, johnny, laughing_clown, joenorris, peefy & joenorris, bugged, xxC0BRAxx,
Klouw & Renegade334, Front242, Klouw & digital.revo, yomero, Siress, wolves,
DonnyC, toadflax, mojo.jojo, cseven, mamba n*p, mynewuser, Ringo, Mac / CP,
MacUK / golfo, trinkett, jazzy786, paulfaz, Ronald MacDonald, DioXin , jerry c,
robertserr, norbert.schuler, zoro25 / golfo, cyber_, PhatKahr4u2c, hyp3r, offtopic,
jJimmyNeutron, Counterhack, ziggy1621, Demonic_Angel, XTCA2S, m00d, marco-
media, codehunter007,AnArmyOfNone, MegaHz, Maerim, xyberpix, D-jump Fizix,
D-jump, Flight Lieutenant Co, windsor_rob, Mac,TPSMC, Navaho Gunleg, EviL
Phreak, sfusion, paulfaz, Jeffball55, rgod + cp clean +, stokaz, Revan-th, Don, xewan,
Blackdata, wifimuthafucka, chadom, ujen, bunker, Klouw & Jimmy Neutro,
JimmyNeutron & murfi, amafui, battletux, lester, rippa, hexsus, jounin, Stealth05,
452_Google_2e_FM.qxd 10/11/07 11:56 AM Page vi
vii
WarChylde, demonio, plazmo, golfo42 & deeper, jeffball55 with cle, MacUK / CP /
Klou, Staplerkid, firefalconx, ffenix, hypetech,ARollingStone, kicktd, Solereaper Rar,
rgod + webby_guy, googler.

ritytribe, Joe Grand, Russ Rogers, Roelof Temmingh, Seth Fogie, Chris Hurley, Bruce
Potter, Jeff, Ping, Eli, Grifter at Blackhat, and the whole Syngress family of authors. I’m
452_Google_2e_FM.qxd 10/11/07 11:56 AM Page vii
viii
honored to be a part of the group, although you all keep me humble! Thanks to
Andrew and Jaime.You guys rule!
Thanks to Apple Computer, Inc for making an awesome laptop (and OS).
—Johnny Long
452_Google_2e_FM.qxd 10/11/07 11:56 AM Page viii
ix
Lead Author
“I’m Johnny. I Hack Stuff.”
Have you ever had a hobby that changed your life? This Google Hacking thing
began as a hobby, but sometime in 2004 it transformed into an unexpected gift. In that
year, the high point of my professional career was a speaking gig I landed at Defcon. I
was on top of the world that year and I let it get to my head—I really was an egotis-
tical little turd. I presented my Google Hacking talk, making sure to emulate the rock-
star speakers I admired.The talk went well, securing rave reviews and hinting at a
rock-star speaking career of my own.The outlook was very promising, but the
weekend left me feeling empty.
In the span of two days a series of unfortunate events flung me from the moun-
taintop of success and slammed me mercilessly onto the craggy rocks of the valley of
despair. Overdone? A bit, but that’s how it felt for me—and I didn’t even get a Balroc
carcass out of the deal. I’m not sure what caused me to do it, but I threw up my hands
and gave up all my professional spoils—my career, my five hundred user website and
my fledgling speaking career—to God.
At the time, I didn’t exactly understand what that meant, but I was serious about
the need for drastic change and the inexplicable desire to live with a higher purpose.
For the first time in my life, I saw the shallowness and self-centeredness of my life, and
it horrified me. I wanted something more, and I asked for it in a real way.The funny

October 2007
Roelof Temmingh Born in South Africa, Roelof studied at the University
of Pretoria and completed his Electronic Engineering degree in 1995. His
passion for computer security had by then caught up with him and mani-
fested itself in various forms. He worked as developer, and later as a system
architect at an information security engineering firm from 1995 to 2000. In
early 2000 he founded the security assessment and consulting firm
SensePost along with some of the leading thinkers in the field. During his
time at SensePost he was the Technical Director in charge of the assessment
team and later headed the Innovation Centre for the company. Roelof has
spoken at various international conferences such as Blackhat, Defcon,
Cansecwest, RSA, Ruxcon, and FIRST. He has contributed to books such
as Stealing the Network: How to Own a Continent, Penetration Tester’s Open
Contributing Authors
452_Google_2e_FM.qxd 10/11/07 11:56 AM Page x
xi
Source Toolkit, and was one of the lead trainers in the “Hacking by
Numbers” training course. Roelof has authored several well known security
testing applications like Wikto, Crowbar, BiDiBLAH and Suru. At the start
of 2007 he founded Paterva in order to pursue R&D in his own capacity.
At Paterva Roelof developed an application called Evolution (now called
Maltego) that has shown tremendous promise in the field of information
collection and correlation.
Petko “pdp” D. Petkov is a senior IT security consultant based in
London, United Kingdom. His day-to-day work involves identifying vul-
nerabilities, building attack strategies and creating attack tools and penetra-
tion testing infrastructures. Petko is known in the underground circles as
pdp or architect but his name is well known in the IT security industry for
his strong technical background and creative thinking. He has been working
for some of the world’s top companies, providing consultancy on the latest

452_Google_2e_FM.qxd 10/11/07 11:56 AM Page xii
xiii
Contents
Chapter 1 Google Searching Basics . . . . . . . . . . . . . . . . . . . 1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
Exploring Google’s Web-based Interface . . . . . . . . . . . . . . . .2
Google’s Web Search Page . . . . . . . . . . . . . . . . . . . . . . . .2
Google Web Results Page . . . . . . . . . . . . . . . . . . . . . . . .4
Google Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
Google Image Search . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Google Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
Language Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Building Google Queries . . . . . . . . . . . . . . . . . . . . . . . . . .13
The Golden Rules of Google Searching . . . . . . . . . . . . .13
Basic Searching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Using Boolean Operators and Special Characters . . . . . .16
Search Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Working With Google URLs . . . . . . . . . . . . . . . . . . . . . . .22
URL Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Special Characters . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Putting the Pieces Together . . . . . . . . . . . . . . . . . . . . . .24
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .46
Chapter 2 Advanced Operators . . . . . . . . . . . . . . . . . . . . . 49
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
Operator Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
Troubleshooting Your Syntax . . . . . . . . . . . . . . . . . . . . .52
Introducing Google’s Advanced Operators . . . . . . . . . . . . . .53

Anonymity with Caches . . . . . . . . . . . . . . . . . . . . . . . . . . .94
Directory Listings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100
Locating Directory Listings . . . . . . . . . . . . . . . . . . . . .101
Finding Specific Directories . . . . . . . . . . . . . . . . . . . . .102
Finding Specific Files . . . . . . . . . . . . . . . . . . . . . . . . . .103
Server Versioning . . . . . . . . . . . . . . . . . . . . . . . . . . . .103
Going Out on a Limb:Traversal Techniques . . . . . . . . . . . .110
Directory Traversal . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
Incremental Substitution . . . . . . . . . . . . . . . . . . . . . . .112
Extension Walking . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .118
452_Google_2e_TOC.qxd 10/11/07 11:08 AM Page xiv
Contents xv
Chapter 4 Document Grinding and Database Digging . 121
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122
Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123
Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130
Office Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . .133
Database Digging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134
Login Portals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135
Support Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137
Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
Database Dumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . .147
Actual Database Files . . . . . . . . . . . . . . . . . . . . . . . . . .149
Automated Grinding . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Google Desktop Search . . . . . . . . . . . . . . . . . . . . . . . . . . .153
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156

Beyond Snippets . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Presenting Results . . . . . . . . . . . . . . . . . . . . . . . . .196
Applications of Data Mining . . . . . . . . . . . . . . . . . . . . . . .196
Mildly Amusing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Most Interesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199
Taking It One Step Further . . . . . . . . . . . . . . . . .209
Collecting Search Terms . . . . . . . . . . . . . . . . . . . . . . . . . .212
On the Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212
Spying on Your Own . . . . . . . . . . . . . . . . . . . . . . . . . .214
Search Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214
Gmail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .217
Honey Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219
Referrals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222
Chapter 6 Locating Exploits and Finding Targets . . . . . 223
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224
Locating Exploit Code . . . . . . . . . . . . . . . . . . . . . . . . . . .224
Locating Public Exploit Sites . . . . . . . . . . . . . . . . . . . .224
Locating Exploits Via Common Code Strings . . . . . . . . . .226
Locating Code with Google Code Search . . . . . . . . . . . . .227
Locating Malware and Executables . . . . . . . . . . . . . . . . . . .230
Locating Vulnerable Targets . . . . . . . . . . . . . . . . . . . . . . . .234
Locating Targets Via Demonstration Pages . . . . . . . . . .235
Locating Targets Via Source Code . . . . . . . . . . . . . . . .238
Locating Targets Via CGI Scanning . . . . . . . . . . . . . . .257
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260
Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .261
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .262
Chapter 7 Ten Simple Security Searches That Work . . . 263

Targeting Web-Enabled Network Devices . . . . . . . . . . . . .326
Locating Various Network Reports . . . . . . . . . . . . . . . . . .327
Locating Network Hardware . . . . . . . . . . . . . . . . . . . . . . .330
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .342
452_Google_2e_TOC.qxd 10/11/07 11:08 AM Page xvii
xviii Contents
Chapter 9 Usernames, Passwords,
and Secret Stuff, Oh My! . . . . . . . . . . . . . . . . . . . . . . . . . 345
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346
Searching for Usernames . . . . . . . . . . . . . . . . . . . . . . . . . .346
Searching for Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . .352
Searching for Credit Card Numbers, Social Security Numbers, and
More . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .361
Social Security Numbers . . . . . . . . . . . . . . . . . . . . . . .363
Personal Financial Data . . . . . . . . . . . . . . . . . . . . . . . .363
Searching for Other Juicy Info . . . . . . . . . . . . . . . . . . . . . .365
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .369
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .369
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .370
Chapter 10 Hacking Google Services . . . . . . . . . . . . . . . 373
AJAX Search API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .374
Embedding Google AJAX Search API . . . . . . . . . . . . .375
Deeper into the AJAX Search . . . . . . . . . . . . . . . . . . .379
Hacking into the AJAX Search Engine . . . . . . . . . . . .384
Calendar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .389
Blogger and Google’s Blog Search . . . . . . . . . . . . . . . . . . .392
Google Splogger . . . . . . . . . . . . . . . . . . . . . . . . . . . . .393
Signaling Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .402

NOSNIPPET: Getting Rid of Snippets . . . . . . . . . . . .485
Password-Protection Mechanisms . . . . . . . . . . . . . . . . .485
Software Default Settings and Programs . . . . . . . . . . . .487
Hacking Your Own Site . . . . . . . . . . . . . . . . . . . . . . . . . .488
Site Yourself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .489
Gooscan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .489
Installing Gooscan . . . . . . . . . . . . . . . . . . . . . . . . .490
Gooscan’s Options . . . . . . . . . . . . . . . . . . . . . . . . .490
Gooscan’s Data Files . . . . . . . . . . . . . . . . . . . . . . . .492
Using Gooscan . . . . . . . . . . . . . . . . . . . . . . . . . . . .494
Windows Tools and the .NET Framework . . . . . . . . . .499
Athena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .500
Using Athena’s Config Files . . . . . . . . . . . . . . . . . . .502
Constructing Athena Config Files . . . . . . . . . . . . . .503
Wikto . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .505
Google Rower . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508
Google Site Indexer . . . . . . . . . . . . . . . . . . . . . . . . . . .510
Advanced Dork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512
Getting Help from Google . . . . . . . . . . . . . . . . . . . . . . . .515
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517
Links to Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .518
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .519
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
452_Google_2e_TOC.qxd 10/11/07 11:08 AM Page xix
452_Google_2e_TOC.qxd 10/11/07 11:08 AM Page xx
1
Google
Searching Basics
Solutions in this chapter:

friends and colleagues.
Exploring Google’s Web-based Interface
Google’s Web Search Page
The main Google Web page, shown in Figure 1.1, can be found at www.google.com.The
interface is known for its clean lines, pleasingly uncluttered feel, and friendly interface.
Although the interface might seem relatively featureless at first glance, we will see that many
different search functions can be performed right from this first page.
As shown in Figure 1.1, there’s only one place to type.This is the search field. In order to
ask Google a question or query, you simply type what you’re looking for and either press
Enter (if your browser supports it) or click the Google Search button to be taken to the
results page for your query.
2 Chapter 1 • Google Search Basics
452_Google_2e_01.qxd 10/5/07 12:12 PM Page 2
Figure 1.1 The Main Google Web Page
The links at the top of the screen (Web, Images, Video, and so on) open the other
search areas shown in Table 1.1.The basic search functionality of each section is the same:
each search area of the Google Web interface has different capabilities and accepts different
search operators, as we will see in Chapter 2. For example, the author operator works well in
Google Groups, but may fail in other search areas.Table 1.1 outlines the functionality of
each distinct area of the main Google Web page.
Table 1.1 The Links and Functions of Google’s Main Page
Interface Section Description
The Google toolbar The browser I am using has a Google “toolbar”
installed and presented next to the address bar. We will
take a look at various Google toolbars in the next sec-
tion.
Web, Images, Video, These tabs allow you to search Web pages,
News, Maps, Gmail and photographs, message group postings, Google maps,
more tabs and Google Mail, respectively. If you are a first-time
Google user, understand that these tabs are not always

options.
Language tools This link allows you to set many different language
options and translate text to and from various lan-
guages.
Google Web Results Page
After it processes a search query, Google displays a results page.The results page, shown in
Figure 1.2, lists the results of your search and provides links to the Web pages that contain
your search text.
The top part of the search result page mimics the main Web search page. Notice the
Images, Video, News, Maps, and Gmail links at the top of the page. By clicking these links
from a search page, you automatically resubmit your search as another type of search,
without having to retype your query.
4 Chapter 1 • Google Search Basics
452_Google_2e_01.qxd 10/5/07 12:12 PM Page 4