It's time for the fifth demo. Let
me show you how you can use Google hacking
to find sensitive data in the URL.
In the URL, you can find different types
of sensitive data. For example an
API key.
If the attacker can learn the API key
then he can use this API key to
read a lot of interesting information from the
API.
What you can see here is the Google search engine
query that you can use for finding API
keys indexed by Google.
The web application is hosted on the
domain hacking web applications.com. That's why
this query starts with site hacking
web applications Comm.
Next there is The Logical operator and
after The Logical operator
and you can see the free most
popular names of the API key that
can be found in the URL.
Most likely the name of the API key will
be either API or key
or API key.
That's why you can see in between round brackets
in. Url API or
in url key or in
url API key.
Okay. Now you understand how this
Google search engine query works.
So let me copy this query.
Let me paste it in Google search and let's
see if Google indexed URLs
containing the API key
on the domain hacking web applications.com.
As you can see one URL with
the API key has been indexed.
Let me click this URL and let me
check what information can be read from the
API by means of this API key.
Please notice that this API
key allows me to read the emails
of other people and hashes of
their passwords.
When you know the hashes of their passwords
The Next Step will be cracking
this passwords. And as I already mentioned
in one of the previous clips for this
purpose, you should use a dedicated tool. For
example, hashcat, which is the
number one offline password cracker.
So as you can see Google hacking
can help you find sensitive data
in the URL and this is
what I presented to you in this demo.
Okay. Now we are done with this demo. So let
me jump to the next one and let me
show you how Google hacking can be used for
finding insecure HTTP web
pages.