It's time for the second demo.
Let me show you how you can use Google hacking
to find sensitive information in SQL
syntax errors.
The four most popular databases are Microsoft
SQL MySQL postgresql and
Oracle.
On this screen, you can see Google search engine
queries that can be used for finding
SQL syntax errors in this databases.
All these queries start with site hacking
web applications.com because the
web application is hosted on this
domain.
After the domain name, you can
see the logical operator and together with
the strings indicating SQL syntax
errors in this databases. The
strings are put in between
round brackets, and there are separated by
The Logical operator or
SQL syntax errors are different for different
databases. And I don't
know which database is used by the web
application hosted on the domain hacking web
applications.com. That's why
I will use this for Google search engine
queries one by one and I
hope to see that Google indexed a
web page with a string indicating and
SQL syntax error in one of these four
most popular databases.
Okay, so far so good.
Let me first copy the Google search engine
query for MySQL.
Let me paste it in Google search and
let's see if Google indexed
a web page with a string indicating and
MySQL syntax error on
the domain hacking web applications Comm.
As you can see Google didn't index
anything related to my search
query.
Okay, next I will go to
my list of search queries.
I will take the second query from this list.
It will be Google search engine query
for Microsoft SQL Server.
I will copy this query.
I will paste it in Google search and I
will check if Google indexed a
web page with a string indicating a
Microsoft SQL Server syntax error
on the domain hacking web applications Comm.
As you can see one web page has
been indexed by Google.
Let's check what is inside?
The Source error and stock Trace are presented
on this web page.
Let's focus on the source error.
There are five lines of the source code and in
the line number 47 the connection
string to the database is defined.
Let's analyze the details of this connection
string.
As you can see there are credentials to the
database and it clearly shows how easily
you can use Google hacking to find
SQL syntax errors with sensitive data
in publicly exposed web pages.
Okay. Now we are done with this demo. So
let me jump to the next one and let me
show you how Google hacking can be used for
finding publicly exposed backup files.