It's time for the 6th demo. Let
me show you how you can use Google hacking to
find insecure HTTP web
pages.
The web application is hosted on the
domain hacking web applications.com.
I want to check if Google indexed insecure
HTTP web pages in
this web application.
For this purpose. I will use the following
Google search engine query.
site hacking web applications.com
and minus sign in URL
https
The queries starts with site hacking
web applications.com because the
web application is hosted on this domain.
Next you can see the logical operator and
after The Logical operator
and there is minus sign
in URL https.
This way I'm asking Google to return
index the web pages that
are not protected by secure https.
In other words, I'm asking Google to
return indexed web pages
that are available over insecure http.
Okay. Now you understand how this Google
search engine query works.
So let me copy this query.
Let me paste it in Google search and let's see
if Google indexed web pages
available over insecure HTTP
on the domain hacking web applications.com.
Please notice that one insecure HTTP
web page has been indexed by
Google.
Let's see this web page.
There is an HTML form with
sensitive data and the sensitive
data is as follows.
full name email phone and password
What's more in the URL bar?
You can see a padlock crossed out
with a red line and it means
that this web page is available over
insecure HTTP. That's why
the sensitive data entered into
this HTML form will be
sent over insecure HTTP, which is
just plain text. And obviously this is
not good from security point of view.
So as you can see Google hacking can help
you find insecure HTTP web
pages and this is what I presented to
you in this demo.
Okay, now we are done with
this demo. So let me jump to the
next clip and let me tell you about Google hacking
database.