‫So while configuring a Web app, one of the common mistakes is to give too much information inside a
‫message.
‫Let's analyze a few examples from a security point of view.
‫Suppose that you were trying to log in to the system and you are compromising the username and password
‫fields, and you don't know any valid username and password.
‫You have a dictionary to try on both the username and the password fields.
‫Your dictionary contains a thousand words you will try a thousand passwords for each username, so theoretically
‫you have a thousand times a thousand tries.
‫Now, if you see this message after an attempt, it probably means that you found a valid username.
‫Now we can just focus on the password field.
‫And this reduces the number of attempts from a million to a thousand.
‫When you see this message, you understand that the username is controlled by the app independently,
‫so forget about the password in the beginning and just focus on the username.
‫When you find the username, try to find the password of that user.
‫So you only have a thousand plus a thousand attempts in this case.
‫This is another helpful message for the hacker.
‫If the message is like this, you have no clue.
‫You have to try every possible user and password combination.
‫In some cases, you can see an error message like this.
‫The developer probably prints the stack trace for debugging purposes.
‫You can collect a lot of sensitive information with such a message.
‫In this example, you will see that the application is written in Perl.
‫Version 5.8 that ate the operating system of the server is Linux, etc. You get the point.
‫So what is all this information we gather everything that we retrieve from the server or the app is
‫information we can use http headers such as server or X powered by headers, error and warning messages
‫that we saw some examples on the previous slide.
‫Comment lines of the web pages may contain sensitive data talked about that before email addresses of
‫the employees or employers.
‫We can use those email addresses to guess the usernames of login pages, or we can use them for social
‫engineering attacks.
‫These are only some of the examples of the information that can be gathered from an application.
‫Why are the search engines are the most typical examples of crawlers?
‫And they let us run queries on the website, we can use the search engines to find out this sensitive
‫information and weaknesses of an application using search engines.
‫Google has advanced search techniques.
‫There are a lot of keywords to use while Googling.
‫Some of them are displayed in this slide.
‫You can find a lot of different queries and W WW Dot Exploit Dash BBC.com Slash Google Dash Hacking
‫Dash database address.
‫So using these previously prepared queries, you can find weaknesses documents which contain usernames
‫and passwords, sensitive folders, web services, error messages which contain sensitive data and backup,
‫and or log files.
‫So here there are just a few examples to show how we can use Google Advanced Search to find valuable
‫information.
‫For example, if we do a search with the words in you URL, Colon, Echo Dot UK and in your URL colon
‫admin, we can find administrative panels of the web sites which have code at UK Super Domain.
‫There are a lot of queries to find the critical points of an application.
‫Thankfully, there are tools to automated these queries for us.
‫Search Diggity found stone site digger and folk are just a few examples of these kinds of tools.