3

recently my logs shows attack signatures from

/news/html/?0'union//select//1//from//(select//count(*),concat(floor(rand(0)*2),0x3a,(select//concat(user,0x3a,password)//from//pwn_base_admin//limit//0,1),0x3a)a//from//information_schema.tables//group//by//a)b//where'1'='1.html

A search on google for pwn_base_admin seems to point to some PHP vulnerability. And something caught my eye is, one of the search results show a link: enter image description here

My question is does how does google crawl sites while inputting such an attack signature? Doesn't it reveal sites that are vulnerable such as the one shown? thanks

  • obviously on some site there is this link and google just follows it – PlasmaHH Nov 11 '15 at 13:47
  • i am confused. Do you name a file using sql statements? – Pang Ser Lark Nov 12 '15 at 6:27
4

Yes Google, as well as other search engines, do see quite a large number of vulnerabilities and misconfigurations on websites. These are indexed and frequently can be searched for either by attackers or security researchers.

There's even a term for it "Google-hacking: https://en.wikipedia.org/wiki/Google_hacking

There are many websites such as the following one which also keep track of these interesting searches: https://www.exploit-db.com/google-hacking-database/

If you know a bit about penetration testing this becomes even easier because you tend to keep track of older versions of applications or plug-ins with easy to exploit holes and you can then use the search engines to find these vulnerable systems on a very large network quickly. For example think of searching for an old version of php anywhere at site:company.com This can quickly help someone find vulnerable systems across what could potentially be over 100,000 publicly available computers ending with company.com.

So yes this does technically allow the world to see the vulnerabilities and search for them a bit easier but there are so many attackers scanning the entire IPv4 address space looking for particularly vulnerable systems that even if this were removed from search engines it wouldn't really put a dent into the number of systems compromised.

Another search engine you may also want to look at is called Shodan https://www.shodan.io/

Shodan lists all sorts of vulnerabilities and it's not restricted to http so it can find telnet, ssh, database vulnerabilities as well.

To their credit Google does filter searches for credit cards now. A long time ago it was possible to search for credit cards and you could find all sorts of misconfigured systems or credit card dumps just via simple searches.

Hopefully this helps.

  • Thanks. What I mean is, how does Google know how to crawl with an attack signature? If you see the lower end of the picture, the link shows a full URL that is embedded with the attack signature. – Pang Ser Lark Nov 11 '15 at 2:44
  • Google doesn't know, per say. What you're seeing is a site that had the full attack signature as a link on it when Google crawled it. Presumably, Googlebot follows it like any other link until they're convinced enough that it's harmful and prevent the bot from following it in the future. – Jeff Stice-Hall Nov 11 '15 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.