Google crawling and SQL injection

Question

recently my logs shows attack signatures from

/news/html/?0'union//select//1//from//(select//count(*),concat(floor(rand(0)*2),0x3a,(select//concat(user,0x3a,password)//from//pwn_base_admin//limit//0,1),0x3a)a//from//information_schema.tables//group//by//a)b//where'1'='1.html

A search on google for pwn_base_admin seems to point to some PHP vulnerability. And something caught my eye is, one of the search results show a link:

My question is does how does google crawl sites while inputting such an attack signature? Doesn't it reveal sites that are vulnerable such as the one shown? thanks

Answer 1

Yes Google, as well as other search engines, do see quite a large number of vulnerabilities and misconfigurations on websites. These are indexed and frequently can be searched for either by attackers or security researchers.

There's even a term for it "Google-hacking: https://en.wikipedia.org/wiki/Google_hacking

There are many websites such as the following one which also keep track of these interesting searches: https://www.exploit-db.com/google-hacking-database/

If you know a bit about penetration testing this becomes even easier because you tend to keep track of older versions of applications or plug-ins with easy to exploit holes and you can then use the search engines to find these vulnerable systems on a very large network quickly. For example think of searching for an old version of php anywhere at site:company.com This can quickly help someone find vulnerable systems across what could potentially be over 100,000 publicly available computers ending with company.com.

So yes this does technically allow the world to see the vulnerabilities and search for them a bit easier but there are so many attackers scanning the entire IPv4 address space looking for particularly vulnerable systems that even if this were removed from search engines it wouldn't really put a dent into the number of systems compromised.

Another search engine you may also want to look at is called Shodan https://www.shodan.io/

Shodan lists all sorts of vulnerabilities and it's not restricted to http so it can find telnet, ssh, database vulnerabilities as well.

To their credit Google does filter searches for credit cards now. A long time ago it was possible to search for credit cards and you could find all sorts of misconfigured systems or credit card dumps just via simple searches.

Hopefully this helps.