This technique is not new, and has been used on several ocassions. I have seen it used - and explained - on a very popular MP3 forum using an apache specific query to find music indexes, It has also been used to find open (whether or not intentional) apache::mp3 sites and CDRom servers connected to the web (Storpoint as far as I remember). I have used it myself in awareness presentations just to show that the recreational hacker will probably not bother you if you've covered the basics including blocking bots - since so many others haven't. Just query for version strings in popular PHP scripts and you'll see what I mean. Or query something like http://www.google.nl/search?q=parent+directory+-htm+-html+port+apache+openss l+0.96+index+server&hl=nl&lr=&ie=UTF-8&oe=UTF-8&start=70&sa=N and go for the sites giving full info on what they run.
Yossarian ----- Original Message ----- From: "Aschwin Wesselius" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, April 18, 2004 9:42 PM Subject: [Full-Disclosure] Any thoughts on War-Googling? > Hello, > > Is there anybody who is common with the technique described in this article? > > http://www.ebcvg.com/articles.php?id=207 > > It says something about using Google to target servers by searching > paths to vulnerabilities. > > Any thoughts on that? > > Kind regards, > > Aschwin Wesselius > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
