Google Hacking

Google's cache is over 95 Petabytes
Google crawls 300 cached entries per host by
default
(If the site's SEO ranking is higher, then Google
crawls deeper)

Getting Google To Scan For You
If a site isn't being crawled for some reason, (like it doesn't have a
DNS entry) you can solve this problem by:
a) Adding a DNS entry for the site publicly
b) Creating a Custom Search under a Google user account
If you create a custom search and add the IP, the
site will be indexed within 7 days

#s
Numbers From Sept 2013
.com sites: 25,270,000,000
.org sites: 2,510,000,000
.jp sites: 15,550,000,000
.cn sites: 1,610,000,000
.ru sites: 1,560,000,000
.uk sites: 982,000,000
.ca sites: 400,000,000
.gov sites: 207,000,000
.us sites: 178,000,000
.mil sites: 5,600,000
.ny.us: 4,870,000
.mn.us: 3,430,000
.ca.us: 3,070,000
.nd.us: 711,000 Numbers From Aug 2015
.com sites: 25,270,000,000
.org sites: 6,560,000,000
.jp sites: 633,000,000
.cn sites: 336,000,000
.ru sites: 1,070,000,000
.uk sites: 2,130,000,000
.ca sites: 1,070,000,000
.gov sites: 814,000,000
.us sites: 178,000,000
.mil sites: 42,300,000
.ny.us: 8,610,000
.mn.us: 15,100,000
.ca.us: 28,200,000
.nd.us: 306,000

Common Functions
1.site:
2.intitle:
3.inurl:
4.filetype:

Examples from 2013
site:gov filetype:log 205,000
site:gov filetype:ini 40,200
site:gov filetype:conf 11,400
site:gov filetype:xls 3,740,000
site:gov filetype:xlsx 137,000
site:gov filetype:doc 12,200,000
site:gov filetype:docx 818,000
filetype:rdp username 774
filetype:xls visa "12/13"
filetype:xls SSN DOB 1965
site:gov filetype:mdb 274
site:gov filetype:sql 7,880
site:mil filetype:sql 1
site:mil filetype:mdb 4
(1 in cache)
site:mil filetype:ini 9
site:mil filetype:txt 696,000
site:mil noforn 95,800
inurl:allstathomehealth.com/Users
filetype:rdp password
inurl:https://mail.piginc.net/bidforms/LF18/115 Bldg. LF-18 NETWARCOM/Badging/
site:s3.amazonaws.com filetype:xls yourcompanyname

A Word of Caution
Hackers love pulling practical jokes on each other. What
constitutes a practical joke is a personal decision that can range
from a funny message, a 'like a sir' image, or deleting your
computer.
You should always hack on a
machine that's useless and
and on a separate network than
Machines containing sensitive
Data.

Rigging a Sweepstakes
Lotteries are fun and all... but they're considerably more
fun when you win. Let's see if we can increase our odds!

Rigging a Sweepstakes
So those numbers count up with each entry, eh? I wonder what
happens when they hit “41/41” ...
Winner!!!
Now tomorrow, we can just watch the entries txt file, wait until it
gets close, and enter when we know we'll win

Something Sinister
That is an admin for a link manager. They have links across their
site that point to the ID numbers. This software tracks the clicks,
then forwards the client on to the destination.
So if we edit the destinations to our phishing sites, visitors would
book a hotel through our phony site!

Kindle
Steps to add file to Kindle:
1. Email file to kindleid@free.kindle.com
2. Wait for file to show up on your Kindle
3. File is automatically stored on Amazon S3

Amazon is a treasure trove of company users, emails,
and social engineering info.
Try it yourself:
site:s3.amazonaws.com filetype:xls

State Auditors – CC#
Document unfortunately taken down
State Gov't – HIPAA Viloation

The above slides were unrelated
●The 2nd was from Texas
●http://socialsecuritynumerology.com Will help you
identify the social security number's prefix if you know
the state and year that the person was born.

Research Labs
Government Research labs have some of the worst
security worldwide.

CERN
Nat'l Lab Directory Traversal
FNAL Fail
Linux Logs
GPS From an Carrier
DARPA Conference
DARPA Conference
Detail
FOIA Request List
Databases in Google