Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The best site to find password leaks: Google

google.com

Post reply on HN
Print view View original

21–30 of 44 posts

Re: The best site to find password leaks: Google

#23

Post by meric »

isani wrote: post #5
meric wrote: post #4

Remember to turn on private browsing.

Private browsing isn't going to help with sites that publish their databases in plaintext, as in the link.

Your browsing history will show your passwords that you searched for to people who use your computer. Also, next time you google search when logged on your password might also show as a suggestion.

Otherwise a password-not-yet-leaked will no longer be. If you didn't turn on private browsing as I suggested and are using Safari, type the password you searched for in your URL bar now and you will see why I said what I said.

Re: The best site to find password leaks: Google

#26

Post by damncabbage »

dools wrote: post #17

How does this actually happen though? Is this simply a case of people leaving the standard "apache index page" turned on or do this many people actually publish links to their SQL files someone crawlable?

Usually a combination of the Apache index pages, dumb server setups, and being people being lazy, careless and/or forgetful when they dump a database to disk.

Also, sometimes an index.html file is accidentally removed, causing (brain-dead installs) to suddenly reveal the contents of a directory, eg. http://shahinfosoft.com/

Re: The best site to find password leaks: Google

#27

Post by Tiomaidh »

eLobato wrote: post #12

Google hacking is truly awesome and powerful. In fact there is some pro material already on the web such as http://johnny.ihackstuff.com/ghdb/ There is also a pretty good book from a spanish Microsoft MVP (yeah it sounds bad but still its an important award, :\) http://www.informatica64.com/libros.aspx?id=hackingBuscadore... It's a shame they decided not to translate it, anyone is up to it here? It contains everythin…

Here's the teaser from the link. I don't own the book and thus have nothing else to translate.

Title: Search Engine Hacking with Google, Bing & Shodan Author: Enrique Rando

Pages: 272

Price: 20 Euros + Shipping (includes IVA)

Though it's been 2500 years since Sun Tzu wrote "The Art of War", many of his lessons remain relevant. His teaching contains several passages that seem especially suitable for people who work in Information Security:

* "Those who disable foreign armies without combat are the best teachers of the Art of War."

* "Before you fight, first learn the skills of the enemy's workers, and then fight them according to their weaknesses."

* "When you can perceive subtlety, winning is easy."

Without a doubt, this information is key in preparing for attempted security breaches. Without it, determining what to attack and how to do it is impossible. Search engines have become important tools for collecting data and other intelligence. However, despite Google hacking's many years of use, its techniques have perhaps not always been well-treated or publically shared.

Re: The best site to find password leaks: Google

#30

Post by widget »

PartyDawg wrote: post #28

It's a shame these companies are so cheap that they don't hire real developers.

It's not necessarily a matter of them being cheap, good developers are hard to find, and the only people who can tell the difference are/were good developers themselves.

This is doubly true with security. There is no cosmetic or usability difference between a secure application and a nightmare that leads to thousands of leaked passwords. So companies that don't already have a good group of developers are screwed when hiring, and companies that don't consider their existing team's decision as the most important factor when hiring are asking for trouble.

Post reply on HN