How to hack hundreds of websites with a single Google search

Disclaimer:
This post doesn’t want to be an invite to hack websites. The admin pages linked by search engines in the “search suggestions” in the article are so easy to find that it’s, I think, exagerated to define this an “hack practice” (infact, many of them were already hacked and spammed by automatic bots ;) ). On the contrary, it wants to be an advice to webmasters and sysadmins to double-check their installations and security measures.

Search engines scan the Web. The entire web, and they often discover something that nobody should see.

This is one of this cases: a webmaster forgets to password-protect the folder where a critical admin tool like phpMyAdmin is, a search engine reaches the folder and it puts in its search index the link.

At this point it’s easy for everyone to discover these security breaches: with a very simple search on a search engine like Yahoo! you’ll get 196 results (November, 7th 2008), they bring to the administrative home page of phpMyAdmin from several domains, with root privileges.

The same search on Google brings 286 results, Live Search other 113 and so on, you’ve only to test other search engines to gain new opened phpMyAdmin page.

This (phpMyAdmin) is only an example: there are a lot of other “magic words” you can try to search around, to discover that, while developers try to fix also the smallest security bug in their softwares every day, there are a lot of sysadmin that leave the door completely open for everyone.

Do you want to suggest some other search? :)

Tag:

This content was posted Friday 7 November 2008 on 5:08 pm in category Tricks. You can follow the comments in this article with its dedicated feed in RSS 2.0. Here you can leave an answer. Pinging is not enabled.

2 commenti

  1. Vitaly Polonetsky said:
    November 7th, 2008

    About five years ago our forum was hacked. Later we were trying to find some suspecious behaviour in the logs. When we found the hacker’s access logs, the first request had refferer of google search with the forum application name and it’s version (which had this security bug). These were on every footer of the forum pages. Later that application removed version number from the footer to prevent these kinds of “bug hunting”.

  2. Scam Away said:
    January 1st, 2009

    It’s good idea to hack and it give a lesson to those careless webmaster.

Leave a comment