DEMYSTIFYING GOOGLE HACKING NOTE -by rahulrajendran9995325060

by
rahulrajendran(kerala,india)
www.achuworld.com


I have been thinking of publishing this paper since long but due
to lack of time I was not able to complete it. I use to add and
keep this paper updated when I get tired of my daily research
work.
Google is world’s most popular and powerful search engine which
has the ability to accept pre-defined commands as inputs and
produce unbelievable results. This enables malicious users like
hackers, crackers, and script kiddies etc to use Google search
engine extensively to gather confidential or sensitive
information which are not visible through common searches.
In this paper I shall cover the below given points that an
administrators or security professionals must take into account
to prevent such information disclosures:
- Google’s Advance Search Query Syntaxes
- Querying for vulnerable sites or servers using Google’s
advance syntaxes
- Securing servers or sites from Google’s invasion



Below discussed are various Google’s special commands and I shall be explaining each command in
brief and will show how it can be used for critical information digging.
[ intitle: ]
The “intitle:” syntax helps Google restrict the search results to pages containing that word in the title. For
example, “intitle: login password” (without quotes) will return links to those pages that has the word
"login" in their title, and the word "password" anywhere in the page.
Similarly, if one has to query for more than one word in the page title then in that case “allintitle:” can be
used instead of “intitle” to get the list of pages containing all those words in its title. For example using
“intitle: login intitle: password” is same as querying “allintitle: login password”.
[ inurl: ]
The “inurl:” syntax restricts the search results to those URLs containing the search keyword. For
example: “inurl: passwd” (without quotes) will return only links to those pages that have "passwd" in the
URL.
Similarly, if one has to query for more than one word in an URL then in that case “allinurl:” can be used
instead of “inurl” to get the list of URLs containing all those search keywords in it. For example: “allinurl:
etc/passwd“ will look for the URLs containing “etc” and “passwd”. The slash (“/”) between the words will
be ignored by Google.
[ site: ]
The “site:” syntax restricts Google to query for certain keywords in a particular site or domain. For
example: “exploits site:hackingspirits.com” (without quotes) will look for the keyword “exploits” in those
pages present in all the links of the domain “hackingspirits.com”. There should not be any space between
“site:” and the “domain name”.
[ filetype: ]
This “filetype:” syntax restricts Google search for files on internet with particular extensions (i.e. doc, pdf
or ppt etc). For example: “filetype:doc site:gov confidential” (without quotes) will look for files with “.doc”
extension in all government domains with “.gov” extension and containing the word “confidential” either in
the pages or in the “.doc” file. i.e. the result will contain the links to all confidential word document files on
the government sites.
[ link: ]
“link:” syntax will list down webpages that have links to the specified webpage. For Example:
“link:www.securityfocus.com” will list webpages that have links pointing to the SecurityFocus homepage.
Note there can be no space between the "link:" and the web page url.


[ related: ]
The “related:” will list web pages that are "similar" to a specified web page. For Example:
“related:www.securityfocus.com” will list web pages that are similar to the Securityfocus homepage. Note
there can be no space between the "related:" and the web page url.
[ cache: ]
The query “cache:” will show the version of the web page that Google has in its cache. For Example:
“cache:www.hackingspirits.com” will show Google's cache of the Google homepage. Note there can be
no space between the "cache:" and the web page url.
If you include other words in the query, Google will highlight those words within the cached document. For
Example: “cache:www.hackingspirits.com guest” will show the cached content with the word "guest"
highlighted.
[ intext: ]
The “intext:” syntax searches for words in a particular website. It ignores links or URLs and page titles.
For example: “intext:exploits” (without quotes) will return only links to those web pages that has the
search keyword "exploits" in its webpage.
[ phonebook: ]
“phonebook” searches for U.S. street address and phone number information. For Example:
“phonebook:Lisa+CA” will list down all names of person having “Lisa” in their names and located in
“California (CA)”. This can be used as a great tool for hackers incase someone want to do dig personal
information for social engineering.


Using “Index of ” syntax to find sites enabled with Index browsing
A webserver with Index browsing enabled means anyone can browse
the webserver directories like ordinary local directories. Here
I shall discuss how one can use “index of” syntax to get a list
links to webserver which has got directory browsing enabled.
This becomes an easy source for information gathering for a
hacker. Imagine if the get hold of password files or others
sensitive files which are not normally visible to the internet.
Below given are few examples using which one can get access to
many sensitive information much easily.
Index of /admin
Index of /passwd
Index of /password
Index of /mail
"Index of /" +passwd
"Index of /" +password.txt
"Index of /" +.htaccess
"Index of /secret"
"Index of /confidential"
"Index of /root"
"Index of /cgi-bin"
"Index of /credit-card"
"Index of /logs"
"Index of /config"


Looking for vulnerable sites or servers using “inurl:” or “allinurl:”
a. Using “allinurl:winnt/system32/” (without quotes) will list
down all the links to the server which gives access to
restricted directories like “system32” through web. If you are
lucky enough then you might get access to the cmd.exe in the
“system32” directory. Once you have the access to “cmd.exe”
and are able to execute it then you can go ahead in further
escalating your privileges over the server and compromise it.
b. Using “allinurl:wwwboard/passwd.txt”(without quotes) in the
Google search will list down all the links to the server which
are vulnerable to “WWWBoard Password vulnerability”. To know
more about this vulnerability you can have a look at the
following link:
http://www.securiteam.com/exploits/2BUQ4S0SAW.html
c. Using “inurl:.bash_history” (without quotes) will list down
all the links to the server which gives access to
“.bash_history” file through web. This is a command history
file. This file includes the list of command executed by the
administrator, and sometimes includes sensitive information
such as password typed in by the administrator. If this file
is compromised and if contains the encrypted unix (or *nix)
password then it can be easily cracked using “John The
Ripper”.
d. Using “inurl:config.txt” (without quotes) will list down all
the links to the servers which gives access to “config.txt”
file through web. This file contains sensitive information,
including the hash value of the administrative password and
database authentication credentials. For Example: Ingenium
Learning Management System is a Web-based application for
Windows based systems developed by Click2learn, Inc. Ingenium
Learning Management System versions 5.1 and 6.1 stores
sensitive information insecurely in the config.txt file. For
more information refer the following links:
http://www.securiteam.com/securitynews/6M00H2K5PG.html



Securing servers or sites from Google’s invasion
Below given are the security measures which system
administrators and security professionals must take into account
to secure critical information available online, falling into
wrong hands:
- Install latest security patches available till date for the
applications and as well as the operating system running on
the servers.
- Don’t put critical and sensitive information on servers
without any proper authentication system which can be
directly accessible to anyone on internet.
- Disable directory browsing on the webserver. Directory
browsing should be enabled for those web-folders for which
you want to give access to anyone on internet.
- If you find any links to your restricted server or sites in
Google search result then it should be removed. Visit the
following link for more details:
http://www.google.com/remove.html
- Disable anonymous access in the webserver through internet
to restricted systems directory.
- Install filtering tools like URLScan for servers running
IIS as webserver.


About Me
There is nothing much that I can tell about myself. Well to
brief in, I spent most of my time doing vulnerability research,
a cup of coffee and internet. That’s all about me.

Comments and suggestion are invited in666rahulraj@gmail.com
To know more about me visit-www.achuworld.com

Fujifilm W1 3D Camera… The Valuable Camera Ever Made: The Review

Fujifilm, a relatively small competitor in India by their own admission, might be seeing a bit more recognition soon. The company has just launched its new FinePix REAL 3D W1, which is the world’s first camera to be able to capture and display images in 3D.

Capturing a 3D image is actually a simple matter of taking two different images of the same object, albeit from slightly different angles, to simulate the way our eyes capture the world around us. However displaying images in 3D is trickier.

This new camera features two lenses, placed at a distance that mimics the distance between human eyes. The best part is that the LCD panel at the back of the camera is capable of displaying 3D images, so you can actually live-preview the image you are taking in 3D without requiring any special glasses. However, unlike some most of the current LCD screens, the viewing angle is once again important here.

The camera offers point-and-shoot functionality for capturing 2D or 3D images or video, and manages everything automatically for the most part. The 3x zoom had to have been especially tricky with the dual lens system.

The camera can capture 2D or 3D images upto 10 megapixels, and can even record videos (2D or 3D) at VGA resolution. Fujifilm has tried to fully utilise the both the CCDs even while shooting 2D images, by allowing you to shoot an image in different modes with the different lenses. For example, you could shoot a close-up image with one and a wide-angle one with the other, all with a single click. The settings for both can be configured separately, so it is possible to capture the same image with different tones or effects.

Fujifilm will also shortly launch a 3D viewer to see the images without special glasses, the FinePix REAL 3D V1. The 8-inch LCD panel will offer some image and video management features. Unfortunately the viewer on display, while it did display images in 3D, also seemed to cause a mild headache. While this could be because of the slightly odd angle of viewing the screen, overall it is not a desirable effect. Not something you'd want to play Crysis on unless a haemorrhage is an acceptable risk.

FujiFilm claims to be the first in the world to offer the ability to not only shoot 3D images with their new 3D camera, and view images with the soon-to-come viewer, but they also offer the facility to print the said images in 3D. With a new service that they will launch soon, you will be able to print your photographs in 3D using lenticular printing.

In all, if you have been waiting for 3D to come to the mainstream, this might be it. 3D photography is only viable if there are means to view, store, and capture images in 3D, and Fujifilm has tried to address all three issues by launching products and services.

With a price of Rs. 42,999 the FinePix REAL 3D W1 it is still rather expensive if you are not explicitly interested in 3D photography

3D SAMPLES EXCLUSIVE UPLOADED FROM JAPAN

IMP NOTIFICATION FOR MOVIE TORRENT DOWNLOADERS

HOW TO SPOT A FAKE "aXXo" OR "FXG" RELEASE!!! (MOST OF THE TIME)
-Ownered this post only by rahulrajendran-cntact 9995325060

aXXo


1 - GENUINE AXXO RELEASES COME WITH 3 FILES: AN .AVI FILE (THE MOVIE) A .TXT FILE (TEXT FILE) AND A .NFO FILE (NFO FILE)

IF THE DOWNLOAD COMES WITH MORE OR LESS THAN THESE 3 FILES, YOU CAN GUARANTEE IT IS A FAKE!

2 - AXXO WILL NOT RELEASE MOVIES IN .RAR FORMAT

IF THE DOWNLOAD COMES COMPRESSED IN RAR FORMAT OR SOMETHING ALONG THOSE LINES, IT IS A FAKE!

3 - AXXO PUTS PERIODS IN THE NAMES OF THE FILES

A GENUINE AXXO RELEASE WILL HAVE A PERIOD BETWEEN EACH WORD, STOPPING BEFORE THE YEAR OF THE MOVIE. EXAMPLE "MY.MOM'S.NEW.BOY.FRIEND[2008]DvDrip-aXXo" NOTICE THERE IS NO PERIOD BETWEEN FRIEND AND [2008]

4 - AXXO SPELLS HIS NAME AS "aXXo" NOT "axxo" OR "AXXO" OR "AxxO"

SOMETIMES THESE FAKERS ARE SO DUMB, THEY CREATE FAKE ONES WHERE AXXO'S NAME IS SPELLED INCORRECTLY

5 - AXXO ONLY RELEASES MOVIES JUST BEFORE THEY COME OUT ON DVD! NOT WHEN THEY ARE IN THEATRES!

6 - THE MAIN FOLDER OR FILE NAME MUST END IN "aXXo" NOT "aXXo.AVI" OR "aXXo.(1).MP4"

THIS IS ON THE MAIN PAGE OF YOUR SEARCH! THE ACTUAL AVI FILE WILL END IN .AVI, BUT I AM TALKING ABOUT THE MAIN SCREEN WHERE YOU SEE MULTIPLE TORRENTS.

7 - AXXO USES THESE BRACKETS AROUND THE YEAR OF THE FILM [2008] NOT THESE BRACKETS (2008)


8 - THE FOLLOWING ARE SOME EXAMPLES OF PROPERLY NAMED AXXO RELEASES:

My.Mom's.New.Boy.Friend[2008]DvDrip-aXXo
The.Onion.Movie[2008]DvDrip.AC3-aXXo
Over.Her.Dead.Body[2008]DvDrip[Eng]-aXXo
Vantage.Point[2008]DvDrip.AC3-aXXo
AS YOU CAN SEE, NOT ALL OF THESE ARE LABLED EXACTLY THE SAME WAY, BUT THEY ARE VERY VERY SIMILAR! ALL OF THEM FOLLOW THE RULES ABOVE AND ARE ALL GENUINE! SOME HAVE "AC3" IN THEM AND SOME HAVE [ENG] IN THEM. IF THE RULES ABOVE ARE FOLLOWED YOU WILL NOT HAVE PROBLEMS WITH FAKES A GREAT MAJORITY OF THE TIME!
9 - THE FOLLOWING ARE SOME EXAMPLES OF INCORRECT FAKE AXXO TORRENTS
The.Love.Guru.[2008]R5.AC3.DvDrip.[Eng]-aXXo - NOTICE THE PERIOD BEFORE [2008]? AND ITS TOO NEW FOR AXXO.
The.Incredible.Hulk.[Eng.2008.DivX].HDTV.AC3.HQ.-aXXo.avi A LOT WRONG WITH THIS! FIGURE IT OUT!
10 - IF YOU ARE EVER IN DOUBT... READ THE USER COMMENTS AND I WILL USUALLY BE THERE WARNING PPL ABOUT FAKES OR TELLING PEOPLE IT IS GENUINE! IF I'M NOT THERE, SOMEONE ELSE SHOULD BE!

FXG (FXG IS A TEAM, AND IS NOT AS CONSISTENT WITH TORRENTS AS AXXO, BUT THERE ARE STILL GOOD WAYS TO SPOT A FAKE)

1 - FXG RELEASES DO NOT COME WITH ANY PERIODS IN THE TITLE LIKE AXXO'S! SOME FAKERS ARE SO DUMB THEY GET CONFUSED AND PUT PERIODS IN FXG RELEASES AND NO PERIODS IN AXXO'S.
2 - FXG RELEASES USUALLY, USUALLY, COME WITH 3 FILES AS WELL: AN .AVI FILE, A .NFO FILE, AND A .SRT FILE (SUBS) THEY ARE NOT ALL LIKE THIS THOUGH, BUT I DO BELIEVE THEY COME WITH AT LEAST 2 FILES NOT JUST 1.
3 - SAME AS AXXO, FXG DOES NOT RELEASE MOVIES IN THEATRES, ONLY WHEN THEY ARE ABOUT TO COME OUT ON DVD.
4 - IN THE UPLOADERS COMMENTS, IT SHOULD SAY WHAT NUMBER OF TEAM MEMBER CREATED THE TORRENT.
5 - GENUINE FXG RELEASES END IN "FXG" AS AXXO'S DO! NOT IN "FXG.AVI" OR ANYTHING SIMILAR!
6 - FXG RELEASES USE THESE BRACKETS AROUND THE YEAR [2008] NOT THESE (2008)
7 - THE FOLLOWING ARE EXAMPLES OF PROPER FXG RELEASES
In Bruges[2008]DvDrip[Eng]-FXG
30 Days of Night[2007]DvDrip[Eng]-FXG
Fool's Gold[2008]DvDrip[Eng]-FXG
AND THE SUMMARY (UPLOADERS COMMENTS) SHOULD LOOK SOMETHING LIKE THIS:
Uploader's Comments:
FXG's 151 rip!!! -----> www.mininova.org/user/FXG {please, SEED...}
Directory: Fool's Gold[2008]DvDrip[Eng]-FXG

Files:

Fool's Gold[2008]DvDrip[Eng]-FXG.avi 701.14 MB
Fool's Gold[Eng][Subs].srt 98.24 KB
FXG™.nfo 4.74 KB
701.24 MB in 3 files. Torrent created 3 weeks ago.

8 - THE FOLLOWING ARE INCORRECTLY NAMED AND FAKES!!!
Expired.(2008)DvDrip(Eng)-FXG NOTICE THE PERIOD AFTER EXPIRED? WRONG!
The.Incredible.Hulk.[MULTILANG].2008.[BEST-QUALI].HG.FXG.avi JUST PLAIN WRONG!
Kung.Fu.Panda.[FRENCH.2008.DVDRiP].HD.DVDSCR.XviD.-FXG.avi NOPE!
9 - IF YOU ARE EVER IN DOUBT... READ THE USER COMMENTS AND I WILL USUALLY BE THERE WARNING PPL ABOUT FAKES OR TELLING PEOPLE IT IS GENUINE! IF I'M NOT THERE, SOMEONE ELSE SHOULD BE!

I HOPE YOU FOUND THIS TORRENT TO BE USEFULL! IF WE ALL PITCH IN WE CAN ELIMINATE THESE FAKERS!!!
by rahulrajendran
chithralayam,VTRA-18
maithanam,varkala