Web

[Sw0rdFish]

##Google Hacking##

What is Google hacking?

Google hacking is the term used when a hacker tries to find exploitable targets and sensitive data by using search engines. The Google Hacking Database (GHDB) is a database of queries that identify sensitive data. Although Google blocks some of the better known Google hacking queries, nothing stops a hacker from crawling your site and launching the Google Hacking Database queries directly onto the crawled content.

The Google Hacking Database is located at http://MeftunNet.ComMore information about Google hacking can be found on: http://www.MeftunNet.Com/error

What a hacker can do if your site is vulnerable

Information that the Google Hacking Database identifies:

Advisories and server vulnerabilities

Error messages that contain too much information

Files containing passwords

Sensitive directories

Pages containing logon portals

Pages containing network or vulnerability data such as firewall logs.

How to check for Google hacking vulnerabilities

The easiest way to check whether your web site & applications have Google hacking vulnerabilities, is to use a Web Vulnerability Scanner. A Web Vulnerability Scanner scans your entire website and automatically checks for pages that are identified by Google hacking queries. (Note: Your web vulnerability scanner must be able to launch Google hacking queries).

The Acunetix Web Vulnerability Scanner scans for SQL injection, Cross site scripting and many more vulnerabilities. For more information & a trial download click here.

Preventing Google hacking attacks

Remove all pages identified by Google hacking queries

Check if your website is vulnerable to attack

Get a free security audit performed by Acunetix staff using Acunetix Web Vulnerability Scanner. Acunetix will scan your website simulating numerous hacking techniques such as SQL injection, cross site scripting, Google hacking and more, in order to identify vulnerabilities in your website. After the scan has completed, you will receive a summary report indicating what - if any - vulnerabilities exist on your site.

##FTP PORT COMMAND^##

1. Introduction

In the past few years, there have been ongoing discussions about problems

related to the PORT command in the FTP protocol. These problems are

based on the misuse of the PORT command in the FTP protocol.

2. The FTP Protocol

To understand these attacks, it is necessary to have a basic

understanding of the FTP protocol [1].

A client opens a connection to the FTP control port (port 21) of an

FTP server. So that the server will be later able to send data back to

the client machine, a second (data) connection must be opened between

the server and the client.

To make this second connection, the client sends a PORT command to the

server machine. This command includes parameters that tell the server

which IP address to connect to and which port to open at that address

- in most cases this is intended to be a high numbered port on the

client machine.

The server then opens that connection, with the source of the connection

being port 20 on the server and the destination being the port identified

in the PORT command parameters.

The PORT command is usually used only in the "active mode" of FTP, which

is the default. It is not usually used in passive (also known as PASV

[2]) mode. Note that FTP servers usually implement both modes, and the

client specifies which method to use [3].

3. The FTP Bounce Attack

To conform with the FTP protocol, the PORT command has the originating

machine specify an arbitrary destination machine and port for the data

connection. However, this behavior also means that an attacker can open a

connection to a port of the attacker's choosing on a machine that may not

be the originating client.

Making this connection to an arbitrary machine for unauthorized purposes

is the FTP bounce attack.

For illustrative purposes only, several examples of how attackers can

use FTP bounce follow.