OK, enough of the amateur stuff. If the random searches that I described in the last paragraph didn't turn up anything, then it's time to use a more focused search. A lot of people don't realize it, but there are a lot of different mechanisms built into Google that you can use to fine tune your search. There isn't one single page that lists all of the Google search mechanisms, but you can read about most of them at: http://www.google.com/help/refinesearch.html and at http://www.google.com/help/operators.html.
The first Google search mechanism that I want to introduce you to is the site query. Let's pretend that I had bought something from your Web site and that my name was therefore included on your customer list. That being the case, you decided to do a Google search against my name; Brien Posey. I have developed a fair amount of content for the Web, and when I performed a Google query against my own name, I received 407,000 results. There is no way that I am going to take the time to scroll through 407,000 results to see if any of the results come from a specific Web site. Fortunately, Google can do this for you. The site query tool allows you to filter the results based on domain. Let's say for example that I only wanted to see pages containing my name that came from the techtarget.com domain. To do so, I would enter my name followed by the word site, a colon, and the domain of choice (in this case techtarget.com). When I run the query, I go from receiving 408,000 results to a mere 748 results.
Brien Posey site:techtarget.com
Of course I am getting 748 results because I have written a whole lot of articles for TechTarget. If I was one of your customers and you were trying to see if my name showed up on your Web site, then hopefully you wouldn't get any results. If you don't get any results, then I don't recommend just stopping and assuming that your site is safe after performing a single query though. Try searching on other items from your customer list or from Web pages that customers should never see, just to see if anything comes up.
Earlier, I mentioned that you may have pages within your site that the public should never see, and that you should get a list of those pages. Hopefully, you have the filenames that make up those pages. If you have a list of the filenames of the pages that should never be seen by the public, you can do a search to see if Google has any knowledge of those pages within your site. The easiest way to do this is to use the INURL tool in conjunction with the SITE tool.
The INURL tool allows you to find pages that contain the search term in the page's URL. Let's say for example that you decided that your site's administrative console should never be seen by the public, and that the console's filename was ADMIN.ASP. You could do an INURL search against the word admin. This would show you pages that have the word admin in the URL. Of course you will still want to use the SITE tool as well so that you are only looking at results from your domain. After all, Google lists almost 50,000 results for pages that have the word admin in the URL.
So let's say that you wanted to search for pages with the word admin in the URL on a site named yoursite.com. That Google query would look something like this:
Inurl: admin site:yoursite.com
Google hacking to test your security
Home: Introduction
Step 1: Identify what could be Google hacked
Step 2: Understand your Web applications
Step 3: Queries to Google hack your site -- Simple stuff
Step 4: More complicated Google queries
Step 5: Harden your Web site against Google hacks
More information from SearchWindowsSecurity.com
Learning Center: Google hack Windows servers
Tip: Google your Windows security vulnerabilities
| ABOUT THE AUTHOR: |
|
Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server and IIS. He has served as CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. As a freelance technical writer, he has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit his personal Web site at www.brienposey.com.
Copyright 2005 TechTarget
|
|
