Instructor: Google hacking. 2 2
Now, when I talk about Google hacking 3 3
I'm not talking about hacking Google servers. 4 4
That's not really what we mean here 5 5
and this often gets students confused. 6 6
Google hacking is a form of open source intelligence. 7 7
It's an open source intelligence technique 8 8
that uses Google search operators to 9 9
locate vulnerable web servers and applications. 10 10
Basically, we can do advanced searches using Google to 11 11
find all sorts of information 12 12
because Google is one of the best search engines out there. 13 13
Now, there are lots of different things that we 14 14
can do when we're doing these advanced operations. 15 15
We can use things like quotes, not, 16 16
and and or, Scope, and URL modifiers. 17 17
Let's talk about each of these really quickly. 18 18
First, we have quotes. 19 19
When you use double quotes 20 20
you get to specify the exact phrase 21 21
and make a search much more precise. 22 22
For example, if I wanted to have the word Jason Dion 23 23
if I just type them into the Google search 24 24
with Jason Space Dion, you're going to end 25 25
up finding everything that relates to Jason or Dion or both. 26 26
But if you put quote Jason Dion, you're only 27 27
going to find words that have Jason Dion together like that. 28 28
Now, that's kind of a silly example 29 29
but you could see how this could be very useful 30 30
as you're trying to narrow down the results 31 31
for a specific phrase or term that you're looking for. 32 32
The next thing we want to talk about is the not operator. 33 33
Now, the not operator uses the minus sign in front of a word 34 34
or quoted phrase to take that out of your search results 35 35
so you don't find that in the results. 36 36
For example, if I wanted to find all of the examples 37 37
of CYSA, but I didn't want anything from Dion training 38 38
I could type in CYSA space minus Dion Training 39 39
and that will give me all the CYSA results 40 40
without any of the Dion training results. 41 41
The next thing we want to talk about is ands and ors. 42 42
These are logical operators 43 43
and they're used to require both search terms 44 44
if you use the and, or either search term 45 45
if you use the or. 46 46
Much like I said, Jason Dion in quotes 47 47
gave me Jason and Dion that would give it 48 48
to me only if they're right next to each other. 49 49
But what if I want every result out there that had Jason 50 50
and Dion in it, but I didn't want them necessarily together? 51 51
For instance, maybe I wanted Jason, middle name, Dion 52 52
or something like that. 53 53
Well, I could just put Jason, the and symbol, and then Dion 54 54
or if I wanted to use the or and get Jason or Dion 55 55
I could use Jason O R for or 56 56
and then Dion or use the pipe character, the up and down 57 57
which is also the character for or. 58 58
The next advanced search term we want to talk 59 59
about is defining your scope. 60 60
Now, you can have different keywords that are 61 61
used to select the scope of the search. 62 62
Things like site, file type, related, all in title 63 63
all in URL, or all in anchor. 64 64
Based on these, you'll put in the word 65 65
like file type, a colon, and then the file type you want. 66 66
For example, if I wanted to search for just PDF files 67 67
I could type file type colon pdf, and then 68 68
whatever my search term was, and I would get only 69 69
results that had PDFs containing that search term. 70 70
-: Lastly, we can use a URL modifier. 71 71
Now, these modifiers can be added 72 72
to the results page to affect your results. 73 73
These are things like, and PWS equals zero 74 74
which means don't give me personalized results 75 75
or and filter equals zero, which says 76 76
don't filter the results or, and TBS equals li:one 77 77
which says, do not autocorrect my search terms. 78 78
Search for it exactly as I typed it. 79 79
All of these are different ways to modify your URL. 80 80
Now, another thing we need to talk about 81 81
when we talk about search hacking 82 82
and Google hacking is the Google hacking database or GHDB. 83 83
Now, the Google Hacking database provides a database 84 84
of different search strings that you can use 85 85
that are already optimized 86 86
for locating vulnerable websites and services. 87 87
This site is maintained by offensive security 88 88
and it contains an entire database of different 89 89
search strings that you can use that are pre-run. 90 90
We like to call these Google dorks. 91 91
You could see here on the screen 92 92
we have a couple of examples, 93 93
and notice they're basically giving you information 94 94
that you can use. 95 95
For example, if you have in title, WebView login, 96 96
alcatel lucent, that might be something to identify switches 97 97
and routers that are alcatel lucent 98 98
that have a login page that's available online, or maybe 99 99
we have something like in title, index of 100 100
WP Security Audit log. 101 101
That may be something that provides us 102 102
with interesting results 103 103
if we're a penetration tester or a bad actor. 104 104
So let's put all this information together 105 105
with a quick example. 106 106
Here on the screen you can see 107 107
a Google search that I'm running using some 108 108
of these advanced characteristics, for example, you see 109 109
google.com/search, and then this big long list. 110 110
Let's break those down individually one at a time. 111 111
First, we have file type. 112 112
The file type is one of those advanced operators that says 113 113
I'm only looking for this type of file, and then 114 114
you see percent three AXLS, which tells me percent three A 115 115
is the colon, but written in this format 116 116
and then XLS saying, I want an Excel spreadsheet file 117 117
so whatever I'm searching for 118 118
it better come back as a spreadsheet. 119 119
Next, you see, I have the word password. 120 120
That's what I'm searching for. 121 121
This is my search term, and then you see, I have site, 122 122
this is the next modifier. 123 123
I only want to find things at a particular website 124 124
and then again, I have percent three a Diontraining.com 125 125
which is colon Dion training.com. 126 126
So what this is telling me 127 127
if I put all this together is find me any files 128 128
that are of file type xls, an Excel spreadsheet, 129 129
that contained the word password 130 130
and are hosted on the site, Diontraining.com. 131 131
Now, if you run this search, you're going to come back 132 132
with zero results, and that's a good thing. 133 133
It means me and my staff are not hosting 134 134
any Excel spreadsheets with the word password 135 135
on our website, but again 136 136
this is a silly example to show you how you can break 137 137
down these different things. 138 138
Now, as a cybersecurity analyst 139 139
do you need to know how to do this? 140 140
Well, yes and no. 141 141
You don't necessarily need to be able to create 142 142
these yourself because you're not trying to attack somebody 143 143
and you're not trying to find out information about them. 144 144
But if you see these type of things in your proxy logs 145 145
you should be able to know what 146 146
that insider is trying to do and what they're searching for 147 147
because you could be held responsible 148 148
as a company for their operations. 149 149
The next area we want to talk about is Shodan. 150 150
Now, Shodan is found at Shodan.io 151 151
and it is a search engine that's optimized 152 152
for identifying vulnerable internet attached devices. 153 153
Basically, Shodan is a website that allows you to 154 154
do a search for all sorts of different devices out there. 155 155
They can search for things like thermostats 156 156
and webcams and ICS and SCADA devices 157 157
and any other kind of device that's out there. 158 158
And the way they do this is they go out 159 159
routinely and they start scanning the entire internet 160 160
and they conduct banner grabbing to identify the types 161 161
of devices and the firmware 162 162
and the OS and the applications that are in use, and 163 163
if those are vulnerable, that now gives us a place to look 164 164
at and start attacking people from. 165 165
Now, again, we are not pen testers and we're not hackers 166 166
so we're not going to be using it in that manner, 167 167
but as a cybersecurity analyst, you could go 168 168
on Shodan and start searching across your devices 169 169
and see if any of yours have been found to be vulnerable 170 170
such as your IP addresses, 171 171
your host names, your geographic location 172 172
or any of your different devices 173 173
that are connected to the internet. 174 174
Again, when you have internet of things 175 175
these are vulnerable, and Shodan is one 176 176
of the ways to find those vulnerabilities. 177 177
Now, let me give you a couple of quick exam tips. 178 178
When it comes to the exam, 179 179
what do you need to know from this lesson? 180 180
Well, as a cybersecurity analyst 181 181
you do not need to put these queries together yourself 182 182
but if I give you a search string 183 183
like that Google search I gave you earlier 184 184
you should be able to read that 185 185
and then pick the results you would expect based on that. 186 186
This is just a basic level 187 187
of analysis that you should be able to do 188 188
if you're going through a proxy log 189 189
and you see somebody doing a Google search.