1.
#pubcon@badams
Using Google to Hack Your Site
Presented by:
Barry Adams
Polemic Digital

2.
#pubcon@badams
About Barry Adams
• Dutchman in Northern Ireland
• Founder of Polemic Digital
• Co-Chief Editor for StateofDigital.com
• Twitter ranter: @badams
• Lecturer & educator

3.
#pubcon@badams
Anatomy of a Hack
1. Reconnaissance
2. Scanning
3. Gaining Access
4. Maintaining Access
5. Covering Tracks

4.
#pubcon@badams
Prevention is the best cure
• Security through obscurity
– Enough to defeat script kiddies
& automated tools
• Won’t stop dedicated hackers
– But then, few things will…

5.
#pubcon@badams
Becoming invisible…

6.
#pubcon@badams
Wappalyzer

7.
#pubcon@badams
Hide your version numbers
<meta name="generator" content="WordPress 4.6.1"/>

8.
#pubcon@badams
Broadcasting your security in robots.txt
• Don’t put your back-end
login folder in your
robots.txt
– Use meta robots
noindex,nofollow

9.
#pubcon@badams
Using Google to find weaknesses
• Google is a hungry beast
• It will crawl & index all it can
• Even stuff it really shouldn’t …
Advanced search commands allow you to
use Google’s insatiable hunger for your
own benefit/protection

10.
#pubcon@badams
Google Advanced Search Commands
site:domain.com > only search within that domain
ext:xxx > only show files with that extension
inurl:xyz > only show pages with ‘xyz’ in the URL
-abc > exclude pages that match ‘abc’
| > string searches together with pipes

11.
#pubcon@badams
Login folders

12.
#pubcon@badams
Database files

13.
#pubcon@badams
Configuration files

14.
#pubcon@badams
Log Files

15.
#pubcon@badams
Backups

16.
#pubcon@badams
Documents

17.
#pubcon@badams
Social Engineering
• Be careful what you publish online!
– Hackers can use personal information to gain
confidence and extract more information.
• Even passwords…

18.
#pubcon@badams
Shared Hosting / Shared Sites
SpyOnWeb.com

19.
#pubcon@badams
Subdomains
https://pentest-tools.com/

20.
#pubcon@badams
To summarise
• Minimise your online footprint;
– Anything online can and will be used against you
• Don’t give away any clues;
– Make your website difficult to reconnoitre
• Educate your staff;
– People are your biggest weakness

21.
#pubcon@badams
Thank You
Follow me on Twitter:
@badams
Email me your questions:
barry@polemicdigital.com