Google hacking - why "numrange" is so dangerous?

Question

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this operator. I found similar claims over the net, however, again, without any example at all how one can use it.

I'm little bit in dark here - I know this operator is dangerous weapon in the hands of a malicious social engineer, but I don't know how one can use this weapon and how to mount self-defence.

I know this operator is used to search for a range of numbers on web. I guess you could use it to track down social numbers (however, I'm not sure how you could pin down a person using the range around social number and not +"insert social number"), phones (let say I know range of phone numbers which is used by targetted organization) and to research an address (to get informations about neighbours). Still, I don't see why this is such an "evil" operator...

So, what is so special about the numrange operator and how can it be used in pen-testing? How can you defend yourself against numrange (not against google hacking as a whole)?

Answer 1

I did little more digging by myself and I was playing with Google for a couple of hours...

The numrange operator was much more problematic when it was introduced by Google than it is now. A couple of years ago you could harvest CC#s, but then Google limited the range of numbers in a query to 5 digits. If you use 6 digits in a query then you get this:

However, it is still possible to harvest SSNs. The trick is to break a number (SSN) into smaller pieces. In the USA, the first three digits of an SSN represent the state. The second group of numbers (2) represents the group number and the last group of digits (4) indicates the serial number.

The query itself could like like:

• +ssn "486..500-01..99-0001..9999"

This would return all SSN from Missouri.

---

The Numrange operator has legitimate uses (unrelated to social-engineering) such as searching for addresses, price ranges, page numbers, years (e.g. Aston Martin 1950..1960) and so on.

Answer 2

Numrange has been criticized for potentially aiding harvesters -- bots that collect large numbers of CC#s, SSNs, emails, etc. Someone who wants to harvest CC#s might only have to write a crawler for google search results instead of crawling a large chunk of the web themselves. Obviously, unless Google takes countermeasures, crawling one website (or using APIs) is easier than crawling the whole web, so the bar for harvesters is lowered.

Since the threat is harvesting, you might want to make sure that CC#s and SSNs do not appear on your site. Doing your own numrange searching through databases, logs, etc. might alert you to threats. For example, if you provide a website that keeps archives of selected user-support conversations to help people diagnose their own problems, it might be a good idea to write your own numrange harvester so you are alerted first if your users' personal information ends up in archives.

Answer 3

While Google has introduced a maximum number of digits in a query, this still works:

http://www.google.com/#q=10e7..10e8+%22sql+dump+version%22

Apparently Google will do the math for you, and it's not filtered. That works with 9 digits, change to -2 -1 of x digits accordingly. I wouldn't say it's an 'evil' operator, but it must be used responsibly. I don't know how long what I did will stick around now that I've posted it, though...

http://seclists.org/fulldisclosure/2012/Oct/159