Researchers Prepare Google Hacking Tools For Black Hat -- Hot Diggity!

Family of search tools will help security teams and pen testers find searchable flaws before bad guys, Stach & Liu researchers say

Go Google-hack yourself.
No, its not a curse. Its a bit of advice being prepared by two researchers who will present a new batch of search engine-based hacking tools at the Black Hat USA conference in Las Vegas next month.
Fran Brown and Rob Ragan, both researchers at the consulting firm Stach & Liu,
are planning to roll out a series of tools
-- dubbed Diggity -- that speed the process of finding security vulnerabilities via Google or Bing. The tools are designed to help enterprises Google hack themselves to identify potential avenues of attack before the bad guys do.
We wanted to find a way to bring search engine hacking back into light because its a pretty effective method of finding vulnerabilities, and we see it being used more and more [by malicious attackers], Ragan says.
Indeed, just last week, the Stach & Liu researchers
offered evidence
that the LulzSec hacker group used Google hacking to choose its targets during its run of hacks on the websites and databases of well-known companies and government organizations.
At Black Hat, the researchers will demonstrate how enterprises can use Google hacking tools on themselves to expose flaws in their data and applications that might be found using a search engine. The tools -- each of which carries the name Diggity -- enable enterprises to search across multiple domains to identify Google-searchable flaws that might lead to common attacks, such as SQL injection and cross-site scripting.
You can do this yourself with Google, but you would typically have to do it on one domain at a time, and that can be incredibly time-consuming when youre an enterprise that has hundreds of domains, Brown says.
Brown compares the Diggity tools to an intrusion detection system that searches for known attacks. The Diggity tools combine the databases of known Google and Bing hacks with Foundstones repository of search engine hacks and Stach & Lius own database, offering a rich store of known hacks and vulnerabilities.
When the tools identify a potential hack, they can send Google Alerts to the security team, giving the enterprise a chance to tell Google to stop indexing them. This step makes the flaws much more difficult to find while the security team is remediating them, Ragan says. A massive RSS feed compiled by Stach & Liu can be customized so that users of the tools can see the threats most likely to apply to their organizations.
In addition to demonstrating the tools, the Stach & Liu researchers will also offer a look at how Google hacking might have been used in a variety of recent, high-profile hacks. For example, the researchers believe Google hacking was behind the Liza Moon virus, which affected more than 4 million websites, injecting malicious SQL codes into popular websites and redirecting users to sites that deliver malware.
Late last month, the entire user database of Groupon’s Indian subsidiary, Sosasta.com, was accidentally published to the Internet, exposing the email addresses and clear text passwords of the site’s 300,000 users. To put it in perspective, if Groupon.com had been using our tools, they would have gotten an alert via iPhone or Droid and found the vulnerability before anyone else did, Brown says.
Have a comment on this story? Please click Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researchers Prepare Google Hacking Tools For Black Hat -- Hot Diggity!