It's time for the fourth demo. Let
me show you how you can use Google hacking to
find internal server errors.
The web application is hosted on
the domain hacking web applications.com.
That's why my Google search engine query
starts with site hacking web
applications.com.
Next I need to type and
entitled 500.
500 is the HTTP status code
for an internal server error.
When this type of error is triggered. The
number of 500 is typically displayed in
the title of the web page.
That's why in my Google search engine query.
I need to type and entitle 500.
Okay. Now you understand how this Google
search engine query works. So let
me copy this query.
Let me paste it in Google search and
let's see if Google indexed a
web page with an internal server error
on the domain hacking web applications.com.
Please notice that the file French
dot PHP cannot be included on
this page and as a consequence, the error
message is displayed instead of
French translation of this web page.
So as you can see there is file inclusion in
this web application and now instead
of French dot PHP. I will
include a sensitive file from the web server.
For example, admin slash
dot hdpass WD.
The dot hdpass WD file
is used to protect the admin directory
and it includes the credentials to
this directory.
That's why I am interested in the content
of this file.
Okay, let me now hit enter
and let's check the credentials inside.
As you can see the login is root
and the password is super secure password.
It clearly shows how easily you can
use Google hacking to find internal server
errors in web applications and afterwards
read the content of sensitive files
from the web servers by means of
this error messages.
Okay. Now we are done with this
demo. So let me jump to the next one and
let me show you how Google hacking can be used
for finding sensitive data in the URL.