Hey everybody welcome to the next video.
So in this video we're going to be talking about our first pass of reconnaissance tool.
Now we're going to be using Google.
So Google crawls almost every web page on the planet.
Now and they they keep a stash of this and there are some unique features that you can use when performing
searches to look for certain things.
So what we're going to take a look here is exploit D.B. dot com has a Google hacking database.
This has got Zee here.
Forty five hundred entries so far.
And this is just different queries looking for different things.
So as an example it's not just simply you know going in here and searching a cat.
Right.
So you can do that but you can look up cat for a specific site using a site keyword and let's say we'll
say you look at Facebook.
So we're looking for the word cat that's on Facebook.
Dot com so you can get very very specific with that.
So if we take a look and we just look at site and then read team nation dot com you could see that the
site is only brings back five results which is the index page the enroll log in.
Why enrolling contact does which is the standard stuff that you would tend to crawl on the site.
Now these are just links on the front page.
And this is done specifically because it's behind a paywall.
So if you're already watching this video obviously you subscribe per month.
So you're behind that paywall already.
Google does not reach there.
Now you can do this for any target.
So this doesn't have to be no resignation.
We can look at go let's say Go Daddy.
Right.
So a domain name though name domain name hosting Web site hosting whatever it is.
Right now they got three point one million results.
Now let's say we want to take a look and see if we can find all PDA files that are publicly available
to go Daddy.
Now the way you do that is we use the site go Daddy dot com.
So that shows us we have our our site.
So anything on this site.
And then we use file type and then whatever we want.
So in this case yes.
So if you go ahead and search this we can see that we've got eight hundred and seventy five results
of PDA documents that are on GoDaddy.
Now in most cases you're going to find that these are not that useful.
However there are some cases where you're going to find something that somebody either has missed configurations
where they've linked it in Google happened to crawl it knows where it is now let's say somebody added
it to a page that went live.
Google crawled the page found the link to the PDA and then they removed it because it wasn't supposed
to be there.
If that's the case you're still going to see it here as long as it's been index by Google beforehand.
Now you can just keep going through you can see there's there's quite a there's quite a list of things
but these are just using specific file types so we can even use the dash keyword or the dash symbol
to remove specific things.
So when we look at Google hacking database none of these are going to be very specific to your engagement.
However for example we can use in U.R.L. Edmund up GHB in your URL admin and then the extension BHP.
So this is going to do is it's going to look for the URL bar up here or in your url.
It's going to look for admin dot Edmund up BHP or admin with an extension of BHP.
So if we go ahead and run this and just run it straight up into Google what we're gonna do is we're
going to find admin log in pages for different sites so in this particular case we're finding one point
seven million.
So if there's an admin that BHP we can then see that this this particular site may have it.
Now if we wanted to look at a specific site we could do Red Team nation dot com.
Now there isn't a admin not BHP on the site.
However if your target was Red Team nation you might do this particular you or L search or google search
to be able to find out if there was one ad enough to be indexed on any part of the site not just just
going slash and not BHP that might not be the case because index will Google this much farther out than
just slash.
See this is calendar slash admin.
This is package slash admin so it's not just the slash.
I mean this is allowing you to find out whether there's an admin page without ever actually touching
the site at all.
I haven't logged into any of this so we can see here get hub dot com WordPress WordPress admin is now
they're so it's important to understand that at this point we've not touched any site.
Even when we issued a site keyword we're letting Google handle the site.
The actual footprint of it for us.
Now there's a lot of aspects here.
So if we go up in here we search password right.
We're gonna find a lot of information around passwords.
So this for example tells us if we're trying to look for a log in this is looking for a registry dump
in on on a Web site.
So there's like tomcat.
That's right.
So the build that x amount might be public which has a tomcat password that's been set.
So we go ahead and search this.
We can see this particular site has it available and they happen to have the value of that.
So this is very simple to use and sometimes it can pull some good results.
Sometimes it can.
Or as this has please change your password and it's looking for and it's removing GitHub from the list
so we can see here one log in.
Do you change your password for my password.
Sometimes this can provide some some interesting things and sometimes it doesn't but it's important
to just get familiar with some of the things that you're looking for not specifically what's in Google
hacking database but more of what they're doing so entitled.
So in the title up at the top manager area and then password but the removing stack overflow.
So in this case we're using another keyword of entitled so easy in here.
Password retrieve lost password and sometimes it matches things pretty good and sometimes it doesn't.
But what's important here is to understand what they're doing.
What key words are they using in Google search engine.
Because you're going to be able to morph these together to be able to find out how you can look for
specific information on the target that you're looking at.
So go ahead and play around with this.
Grab a few of these and just see what pops up.
So for example Data's database password.
Just go ahead and throw this into google
so we can see here we've got quite a few.
So I'm not what I don't want you to do is go ahead and start clicking around on these sites.
I want you to stay specifically on Google.
Don't click around and actually go to the the Web site itself because in some cases config files like
let's say you this you are a password for that was found in a production log database or protection
log file it happens to be available.
What you don't want to do is be clicking on these.
So that way when a particular admin finds out that this page has been accessed they're going to start
looking and start investigating past that point.
So what I want you to do is unless you own the site that you're looking at or have approval don't touch
the site.
Just look at it do Google.
Remember we're doing passive.
We're not doing anything active right now.
We are just recording data that we might want to use.
Now there is a feature that I just want to mention here we're not going to have a specific video on
it.
However I believe it's called the Wayback Machine.
So what you can do and in some cases on some sites you can see what a Web site looked like years ago
days ago weeks ago.
So it might be good to take a look at what sites were maybe a year back and you might be able to find
some useful information.
It's not always going to work however it does.
It might provide you some indication especially if you see e-mail traffic or you got with that in a
certain time ago let's say two years ago they accidentally had something leaked there for quite a while
this might have already indexed and grabbed the page so you might be able to see what information was
present.
So go ahead and play around with this.
Start using different search results tested on Web sites that any Web site really just make sure that
you don't actually visit the site because again we're striking we're teaching this as a passive technique.
This can be active if you start actually viewing the site itself such as you know logs or e-mail files
or anything like that you want to Stickley stay off of that just because it's past.