Question 1 – Google Reconnaissance

Computer attackers are able to gather unprotected information using Google search to attack such computers. This is known as “Google reconnaissance”. The steps below illustrate how the information could be collected for carrying out such an attack.

Uncover MS Excel files with login infomation

Below steps illustrate how a Google search can be performed to retrieve MS Excel files containing user id and password information in clear text. These could then be used to log into or gain access into the computer system or the network.

step 1

Use Google advanced search, search words containing “login:*” “password=*”, select file types MS excel “.xls”, then click advanced search.

step 2

Below screen shows 1st page of results found by Google that matches the search criteria.

step 3

The screen below shows contents of a MS Excel file that contains an actual user id and a password value for a web site with the URL of the web site.

Uncover Text files with login infomation

A similar search can be performed to search for text files that contain user id and password values.

step 1

The search criteria is, “index.of passlist” as the search word and any format as the file type.

step 2

Below screen displays 1st result page returned by Google.

step 3

Examining the results many did not contain an actual file with user id and password values.

step 4

A slight modification was done to the search as "index.of password" and click search button. The results returned are shown below

step 5

Following the first link displayed the contents of a directory index of a site with a list of files and possibly links to a password file as shown below.

step 6

Click the link passlist.txt and it provides access to what appears to be a admin user id and password which is unprotected as shown below.