Google hacked by a Dead Cow

David Heath
Monday, 25 February 2008 16:55

Your IT - Home IT

The well-known Hackers’ group, Cult of the Dead Cow, recently announced the availability of a new tool called “Goolag Scanner.”  This encapsulates many of the Google hacks made popular by the well-known hacker Johnny I Hack Stuff.

For some time now, a variety of “Google Hacks,” or ways to use Google to extract interesting hacker information from websites around the world, have been widely circulated.  As a very simple example, try hitting Google with a search like this:

"Belarc Advisor" +"current profile"

Amongst other hits (I had 207,000!), you’ll find plenty of on-line summaries of Belarc Advisor system scans – including serial numbers of all major software packages installed on the scanned PCs; particularly Microsoft licences.  If you don’t known what Belarc is, I suggest you look into it very soon – it’s a very useful tool, especially if you don’t post the results online, unlike far too many people!

In releasing the tool, spokesperson Oxblood Ruffin (why do all hackers need an odd Nic?) comments “Goolag Scanner provides one more tool for web site owners to patch up their online properties.  We've seen some pretty scary holes through random tests with the scanner in North America, Europe, and the Middle East.  If I were a government, a large corporation, or anyone with a large web site, I'd be downloading this beast and aiming it at my site yesterday.  The vulnerabilities are that serious.”

So, how does Goolag Scanner work?  Download it from any of the mirrors linked from the Goolag site and follow the simple install.  Upon running it, a nice GUI interface presents you with a grouped list of 1418 “dorks” or Google hacks, which can be used to scan for exposed websites.  By default, the scanner expects you to offer your own site for initial scan – and that’s probably the most important scan anyone can do. 

If you don’t choose your own site, you can give the software a specific URL to scan.  Fortunately, there is no facility (yet!) to perform wide-ranging scans from this tool.  It’s one site at a time.

After you’ve exhausted the tool as presented, be inventive; create your own Google hacks.  Who knows what you might find on your own site. Or someone else’s for that matter!

As they say, try it, you’ll like it.