Google hacking for penetration tester - part 15 pdf

Table 4.7 continued Queries That Locate Database Error Messages
Description Query
ColdFusion error message, can intitle:”Error Occurred While Processing
reveal SQL statements and server Request”
information
ColdFusion error message, can intitle:”Error Occurred” “The error occurred
reveal source code, full pathnames, in” filetype:cfm
SQL query info, database name,
SQL state information, and local
time information
Coldfusion Error Pages reveal “Error Diagnostic Information”
many different types of information intitle:”Error Occurred While”
DB2 error message can reveal “detected an internal error [IBM][CLI
path names, function names, Driver][DB2/6000]”
filenames, partial code and
program state
DB2 error message can reveal An unexpected token “END-OF-STATE
path names, function names, MENT” was found
filenames, partial code and
program state
DB2 error message, can reveal “detected an internal error [IBM]
pathnames, function names, [CLI Driver][DB2/6000]”
filenames, partial code, and
program state
DB2 error message, can reveal An unexpected token “END-OF-STATE
pathnames, function names, MENT” was found
filenames, partial code, and
program state
Discuz! Board error may reveal filetype:php inurl:”logging.php”
path information or partial SQL “Discuz” error
code listings

Generic SQL message, can reveal “You have an error in your SQL syntax
pathnames and partial SQL code near”
Generic error can reveal path “Warning: Supplied argument is not a valid
information File-Handle resource in”
Generic error message can be used intitle:”Under construction” “does not
to determine operating system currently have”
and web server version
Document Grinding and Database Digging • Chapter 4 141
Continued
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 141
Table 4.7 continued Queries That Locate Database Error Messages
Description Query
Generic error message can reveal “Fatal error: Call to undefined function” -
compiler used, language used, reply -the -next
line numbers, program names
and partial source code
Generic error message reveals “Warning:” “SAFE MODE Restriction in
full path information effect.” “The script whose uid is” “is not
allowed to access owned by uid 0 in” “on
line”
Generic error message, reveals “Error Diagnostic Information”
various information intitle:”Error Occurred While”
Generic error messages reveal path intext:”Warning: Failed opening” “on line”
names, php file names, line “include_path”
numbers and include paths
Generic error reveals full path info “Warning: Division by zero in” “on line” -
forum
HyperNews error reveals the server intitle:”Error using Hypernews” “Server
software, server OS, server account Software”
user/group (unix), server

administrator email address, and
even stack traces
IIS 4.0 error messages reveal the intitle:”the page cannot be found” inetmgr
existence of an extremely old
version of IIS
IIS error message reveals somewhat intitle:”the page cannot be found”
unmodified (and perhaps “internet information services”
unpatched) IIS servers
Informix error message can reveal “A syntax error has occurred” filetype:ihtml
path names, function names,
filenames and partial code
Informix error message can reveal “An illegal character has been found in the
path names, function names, statement” -”previous message”
filenames and partial code
MYSQL error message reveals “supplied argument is not a valid MySQL
path names result resource”
MySQL error message can reveal “mySQL error with query”
a variety of information.
MySQL error message can reveal “Can’t connect to local” intitle:warning
database name, path names and
partial SQL code
142 Chapter 4 • Document Grinding and Database Digging
Continued
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 142
Table 4.7 continued Queries That Locate Database Error Messages
Description Query
MySQL error message can reveal “You have an error in your SQL syntax
path names and partial SQL code near”
MySQL error message can reveal “ORA-00921: unexpected end of SQL
path names, function names, command”

filenames and partial SQL code
MySQL error message can reveal “Supplied argument is not a valid MySQL
path names, function names, result resource”
filenames and partial SQL code
MySQL error message can reveal “Incorrect syntax near”
path names, function names,
filenames and partial code
MySQL error message can reveal “Incorrect syntax near” -the
path names, function names,
filenames and partial code
MySQL error message can reveal “Unclosed quotation mark before the
path names, function names, character string”
filenames and partial code
MySQL error message can reveal “access denied for user” “using password”
the username, database, path
names and partial SQL code
MySQL error message, reveals real “supplied argument is not a valid MySQL
pathnames and listings of other result resource”
PHP scripts on the server
MySQL error message, reveals “MySQL error with query”
various information
MySQL error reveals database “Warning: mysql_query()” “invalid query”
schema and usernames.
Netscape Application Server or intitle:”404 SC_NOT_FOUND”
iPlanet application servers error
reveals the installation of
extremely outdated software.
ODBC SQL error may reveal table filetype:asp + “[ODBC SQL”
or row queried, full database
name and more

Oracle SQL error message, reveals “ORA-00921: unexpected end of SQL
full Web pathnames and/or php command”
filenames
Document Grinding and Database Digging • Chapter 4 143
Continued
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 143
Table 4.7 continued Queries That Locate Database Error Messages
Description Query
Oracle SQL error message, “ORA-00933: SQL command not properly
reveals pathnames, function names, ended”
filenames, and partial SQL code
Oracle SQL error message, reveals “ORA-00936: missing expression”
pathnames, function names,
filenames, and partial SQL code
Oracle error message can reveal “ORA-00933: SQL command not properly
path names, function names, ended”
filenames and partial SQL code
Oracle error message can reveal “ORA-00936: missing expression”
path names, function names,
filenames and partial database code
Oracle error message may reveal “ORA-12541: TNS:no listener” intitle:
partial SQL code, path names, ”error occurred”
file names, and data sources
Oracle error message, reveals SQL “ORA-12541: TNS:no listener” intitle:
code, pathnames, filenames, and ”error occurred”
data sources
PHP error logs can reveal various filetype:log “PHP Parse error” |
types of information “PHP Warning” | “PHP Error”
PHP error message can reveal path “Warning: Cannot modify header inform-
names, function names, filenames ation - headers already sent”

and partial code
PHP error message can reveal the “The script whose uid is “ “is not allowed
webserver’s root directory and to access”
user ID
PHP error messages reveal path PHP application warnings failing
names, PHP file names, line numbers “include_path”
and include paths.
PHP error reveals web root path “Parse error: parse error, unexpected
T_VARIABLE” “on line” filetype:php
PostgreSQL error message can “Warning: pg_connect(): Unable to connect
reveal path information and to PostgreSQL server: FATAL”
database names
PostgreSQL error message can “PostgreSQL query failed: ERROR: parser:
reveal path names, function names, parse error”
filenames and partial code
144 Chapter 4 • Document Grinding and Database Digging
Continued
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 144
Table 4.7 continued Queries That Locate Database Error Messages
Description Query
PostgreSQL error message can “Supplied argument is not a valid
reveal path names, function names, PostgreSQL result”
filenames and partial code
PostgreSQL error message, can “PostgreSQL query failed: ERROR: parser:
reveal pathnames, function names, parse error”
filenames, and partial code
PostgreSQL error message, can “Supplied argument is not a valid
reveal pathnames, function names, PostgreSQL result”
filenames, and partial code
Postgresql error message, “Warning: pg_connect(): Unable to connect

reveals path information and to PostgreSQL server: FATAL”
database names
SQL error may reveal potential “[SQL Server Driver][SQL Server]Line 1:
SQL injection points. Incorrect syntax near” -forum -thread -
showthread
SQL error message reveals full “Invision Power Board Database Error”
path info
SQL error message reveals full “ORA-00921: unexpected end of SQL
pathnames and/or PHP filenames. command”
SQL error message, can reveal “Can’t connect to local” intitle:warning
pathnames, function names,
filenames, and partial code
(variation)
SQL error message, can reveal “Incorrect syntax near” -the
pathnames, function names,
filenames, and partial code
(variation)
SQL error message, can reveal “access denied for user” “using password”
pathnames, function names,
filenames, and partial code
(variation)
SQL error message, can reveal “Incorrect syntax near”
pathnames, function names,
filenames, and partial code
SQL error message, can reveal “Unclosed quotation mark before the
pathnames, function names, character string”
filenames, and partial code
Document Grinding and Database Digging • Chapter 4 145
Continued
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 145

Table 4.7 continued Queries That Locate Database Error Messages
Description Query
Sablotron XML error can reveal warning “error on line” php sablotron
partial source code, path and
filename information and more
Snitz Microsoft Access database databasetype. Code : 80004005. Error
error may reveal the location and Description :
name of the database, potentially
making the forum vulnerable to
unwanted download
Softcart error message may intitle:Configuration.File inurl:softcart.exe
reveal configuration file location
and server file paths
This dork reveals logins to “Warning: mysql_connect(): Access denied
databases that were denied for for user: ‘*@*” “on line” -help -forum
some reason.
Windows 2000 error messages intitle:”the page cannot be found” “2004
reveal the existence of an microsoft corporation”
extremely old version of Windows
cgiwrap error message reveals intitle:”Execution of this script not
admin name and email, port permitted”
numbers, path names, and may
also include optional information
like phone numbers for support
personnel
ht://Dig error can reveal intitle:”htsearch error” ht://Dig error
administrative email, validation of
a cgi-bin executable directory,
directory structure, location of a
search database file and possible

naming conventions
vbulletin error reveals SQL “There seems to have been a problem with
code snippets the” “ Please try again by clicking the
Refresh button in your web browser.”
In addition to revealing information about the database server, error messages can also
reveal much more dangerous information about potential vulnerabilities that exist in the
server. For example, consider an error such as “SQL command not properly ended”, displayed in
Figure 4.9.This error message indicates that a terminating character was not found at the
end of an SQL statement. If a command accepts user input, an attacker could leverage the
information in this error message to execute an SQL injection attack.
146 Chapter 4 • Document Grinding and Database Digging
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 146
Figure 4.9 The Discovery of a Dangerous Error Message
Database Dumps
The output of a database into any format can be constituted as a database dump. For the
purposes of Google hacking, however, we’ll us the term database dump to describe the text-
based conversion of a database. As we’ll see next in this chapter, it’s entirely possible for an
attacker to locate just about any type of binary database file, but standardized formats (such
as the text-based SQL dump shown in Figure 4.10) are very commonplace on the Internet.
Figure 4.10 A Typical SQL Dump
Document Grinding and Database Digging • Chapter 4 147
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 147
Using a full database dump, a database administrator can completely rebuild a database.
This means that a full dump details not only the structure of the database’s tables but also
every record in each and every table. Depending on the sensitivity of the data contained in
the database, a database dump can be very revealing and obviously makes a terrific tool for
an attacker.There are several ways an attacker can locate database dumps. One of the most
obvious ways is by focusing on the headers of the dump, resulting in a query such as
“#Dumping data for table”, as shown in Figure 4.10.This technique can be expanded to work
on just about any type of database dump headers by simply focusing on headers that exist in

every dump and that are unique phrases that are unlikely to produce false positives.
Specifying additional specific interesting words or phrases such as username, password,or
user can help narrow this search. For example, if the word password exists in a database dump,
there’s a good chance that a password of some sort is listed inside the database dump. With
proper use of the OR symbol ( | ), an attacker can craft an extremely effective search, such
as “# Dumping data for table” (user | username | pass | password). In addition, an attacker
could focus on file extensions that some tools add to the end of a database dump by
querying for filetype:sql sql and further narrowing to specific words, phrases, or sites.The
SQL file extension is also used as a generic description of batched SQL commands.Table
4.8 lists queries that locate SQL database dumps.
Table 4.8 Queries That Locate SQL Database Dumps
Query Description
inurl:nuke filetype:sql php-nuke or postnuke CMS dumps
filetype:sql password SQL database dumps or batched SQL com-
mands
filetype:sql “IDENTIFIED BY” –cvs SQL database dumps or batched SQL com-
mands, focus on “IDENTIFIED BY”, which
can locate passwords
“# Dumping data for table SQL database dumps or batched SQL
(username|user|users|password)” commands, focus on interesting terms
“#mysql dump” filetype:sql SQL database dumps
“# Dumping data for table” SQL database dumps
“# phpMyAdmin MySQL-Dump” SQL database dumps created by
filetype:txt phpMyAdmin
“# phpMyAdmin MySQL-Dump” SQL database dumps created by
“INSERT INTO” -”the” phpMyAdmin (variation)
148 Chapter 4 • Document Grinding and Database Digging
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 148
Actual Database Files
Another way an attacker can locate databases is by searching directly for the database itself.

This technique does not apply to all database systems, only those systems in which the
database is represented by a file with a specific name or extension. Be advised that Google
will most likely not understand how to process or translate these files, and the summary (or
“snippet”) on the search result page will be blank and Google will list the file as an
“unknown type,” as shown in Figure 4.11.
Figure 4.11 Database Files Themselves Are Often Unknown to Google
If Google does not understand the format of a binary file, as with many of those located
with the filetype operator, you will be unable to search for strings within that file.This consid-
erably limits the options for effective searching, forcing you to rely on inurl or site operators
instead.Table 4.9 lists some queries that can locate database files.
Document Grinding and Database Digging • Chapter 4 149
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 149
Table 4.9 Queries That Locate Database Files
Query Description
filetype:cfm “cfapplication name” ColdFusion source code
password
filetype:mdb inurl:users.mdb Microsoft Access user database
inurl:email filetype:mdb Microsoft Access e-mail database
inurl:backup filetype:mdb Microsoft Access backup databases
inurl:forum filetype:mdb Microsoft Access forum databases
inurl:/db/main.mdb ASP-Nuke databases
inurl:profiles filetype:mdb Microsoft Access user profile databases
filetype:asp DBQ=” * Server. Microsoft Access database connection
MapPath(“*.mdb”) string search
allinurl: admin mdb Microsoft Access administration databases
Automated Grinding
Searching for files is fairly straightforward—especially if you know the type of file you’re
looking for. We’ve already seen how easy it is to locate files that contain sensitive data, but in
some cases it might be necessary to search files offline. For example, assume that we want to
troll for yahoo.com e-mail addresses.A query such as “@yahoo.com” email is not at all effec-

tive as a Web search, and even as a Group search it is problematic, as shown in Figure 4.12.
Figure 4.12 A Generic E-Mail Search Leaves Much to Be Desired
150 Chapter 4 • Document Grinding and Database Digging
452_Google_2e_04.qxd 10/5/07 12:42 PM Page 150