How Google works. Finding words with additional operators

This is followed by the main function to display a fixed number of user messages (the value retrieved from the administrative settings table):

<% Sub Show NumPerPage=INT(objRec2("NumPerPage")) If Request.QueryString("page") = "" Then iPageCurrent = 1 Else iPageCurrent = CInt(Request.QueryString("page")) End If Set objRec = Server.CreateObject ("ADODB.Recordset") StrSql = "SELECT * FROM Messages ORDER BY ID DESC;" objRec.PageSize = NumPerPage objRec.CacheSize = NumPerPage objRec.Open StrSql,objConn,3,1,&H0001 iPages = objRec.PageCount TotalRows = objRec.RecordCount If iPageCurrent >iPages Then iPageCurrent = iPages If iPageCurrent< 1 Then iPageCurrent = 1 If iPages = 0 Then Response.Write "Не найденно записей!" Else ObjRec.AbsolutePage = iPageCurrent %>

"color="<%=objRec2("PageFontColor")%>"size="<%=objRec2("PageFontSize")%>"> Total in the book <%=TotalRows%> entries on <%=iPages%> page(s)

"> "color="<%=objRec2("InfoFontColor")%>"size="<%=objRec2("InfoFontSize")%>"><%=ObjRec("DateID") %>		"> "color="<%=objRec2("InfoFontColor")%>"size="<%=objRec2("InfoFontSize")%>">Site rating: .gif" height="14" width="65">
"> "color="<%=objRec2("MessageFontColor")%>"size="<%=objRec2("MessageFontSize")%>"><%=FormatStr(ObjRec("Message"))%>
"> "color="<%=objRec2("InfoFontColor")%>"size="<%=objRec2("InfoFontSize")%>"> <% If IsEmpty(Email) or Email=" " then Response.Write Name Else Response.Write "" & Name End If %>	"> "color="<%=objRec2("InfoFontColor")%>"size="<%=objRec2("InfoFontSize")%>"><%=FormatStr(ObjRec("Country")) %> IP:<%= ObjRec("IP") %>	"> "color="<%=objRec2("InfoFontColor")%>"size="<%=objRec2("InfoFontSize")%>"> <%=Link%>

"color="<%=objRec2("PageFontColor")%>"size="<%=objRec2("PageFontSize")%>"> Pages: <% For I = 1 To iPages If I = iPageCurrent Then Response.Write ""&I&"" Else Response.Write " "&I&"" End If Next Response.Write "" Else Response.Write " " End If End If objRec.Close Set objRec = Nothing End Sub %>

Pay attention to how the link to view the next page with such a “portion” of messages is formed and implemented:

Response.Write" "&I&" "

As you can see, the page number is passed to it as the value of the page parameter, and subsequently, if this value is not equal to 1, the display of messages does not start from the first message, but from the one that will be the first one on the page with the corresponding number specified in the parameter:

<% NumPerPage=INT(objRec2("NumPerPage")) If Request.QueryString("page") = "" Then iPageCurrent = 1 Else iPageCurrent = CInt(Request.QueryString("page")) End If %>The source text of the module itself follows, in which the connection to the database is made and records are retrieved (in the described example, this will be the only record) from the Admin administrative settings table:<% Set objConn = Server.CreateObject ("ADODB.Connection") objConn.Open StrConn Set objRec2 = Server.CreateObject ("ADODB.Recordset") ConfigSql = "SELECT * FROM Admin;" objRec2.Open ConfigSql,objConn,0,1,&H0001 %>

Then you can style the title and main tags of the HTML page:

Conclusion

We considered one more functional component of the site, and immediately made it portable. The result of this was a rather complex source code in terms of perception. Although a large number of parameters retrieved from the administrative table made it somewhat more difficult to understand the source code of the module, however, using them once and for all will save you from having to edit the code when they change. The system developed by us is quite acceptable in use, and thanks to the modularity of its implementation and the approach to its implementation in existing sites described in the article, it can be used as a guest book on a site of almost any degree of complexity.

Of course, the Web interface for editing, adding and deleting administrative settings (schemes) should also be considered, but this will take a lot of time, and therefore the author will try to cover it in one of the following parts of this article.

ComputerPress 11 "2001

Registration of controls is carried out by the @Register directive, which allows you to use user controls and server controls in the HTML code of the page using a special syntax (declarative custom server control syntax). Based on the analysis of these directives, the page parser can associate tags with given types and, when creating a page, embed controls already as containers of custom types - branches of the page's control tree.

Directives must precede the first use of the declared tags, more often they are placed at the beginning of the page and in the case of registering several controls, in sites with a modular structure, the number of such declarations can occupy a large number of lines. When you change the location of controls, you have to look for lines that require changes in the code of all pages and user controls on which they are registered, which is rather inconvenient.

The article describes a method that simplifies the registration of controls.

For the registration directives, we will use a plain text file in which we will collect all the @ Register directives. Since virtual paths can be used to declare user controls, and only namespaces are specified for server controls, we can collect all the links we need in this file, and the links to the ascx files will be correct for any folder in the project. Here is what this file looks like in one of the projects:

Let's name the file register.inc and place it in the /inc folder of our web project.

This file will contain all the links we need, we will add or change the registration of a user or server control in it.

Now the created file needs to be somehow included in the page code. We do this with the SSI (server side includes) #include directive. This directive allows you to include static and dynamic files in the page code, processing them based on IIS mapping, i.e. specifying an asp or aspx file as the source will cause the file to be processed by the appropriate process and copy the results of this processing to the output page. In ASP, the #include directive was very widely used and allowed for the modularization of the site. With the advent of ASP.NET, it has become more convenient to do this in other ways, for example, using user controls. Future versions of ASP.NET will implement modularity using master pages. In general, the #include directive lost its meaning and was kept mainly for backward compatibility and to simplify the migration of ASP projects to .Net.

Since we have a simple text file, no processing will be done, and before any dynamic content is executed, the entire contents of the file will be copied into the page code. Those. adding our register.inc file to the top of the page, for example, is almost the same as writing all the @Register directives there.

In order not to depend on the physical location of the file, we again use the virtual path syntax and add the following line to the aspx file code:

Make sure everything works, if not, correct the wrong paths.

It remains to carry out one more operation. Now, if you try to get the /inc/register.inc file from the link in your browser, you can easily do it. IIS puts it in your hands, as well as in the hands of an attacker, completely free, although it contains the paths of the physical structure of your site.

To prevent this from happening, we use the capabilities of the synchronous HttpForbiddenHandler handler, which allows us to protect files of a certain type from being issued at the request of the user. This approach is convenient and is often used, for example, to protect MS Access database files used in a project. In order for files with the *.inc extension to be protected using this handler, you need to tell IIS that these files will be processed by the ASP.NET process, in other words, configure IIS to map to files of this type.

For a detailed description of the configuration process for IIS, see HOW TO: Use ASP.NET to Protect File Types (http://support.microsoft.com/kb/815152/EN-US/). We need to create a mapping only for *.inc files. After completing the steps described there, all requests for files with this extension will be processed by the ASP.NET process, and you will have to edit the web.config file as follows:

That's it, now when trying to get the /inc/register.inc file via a direct link, the user will receive error B.

In order not to register aspnet_isapi.dll, for example, your provider does not want to do this, you can use the SSI ability to specify files of any type and cheat by using an extension of one of the types already mapped in IIS by default for a file with @Register directives. *.cs or *.vb extensions will be convenient for this. These files contain source code and are usually not copied to the server. If you suddenly made a mistake and copied them, you won’t be able to get them at the request from the browser - when you try to do this, the user will receive an error B. This happens because for files of this type, mapping in IIS is configured by default and the corresponding extension is already registered in the section machine.config file. In Visual Studio, in order for the compiler not to give you an error message, put an extension that the compiler is not interested in: in C# projects it is *.vb, in VB projects it is *.cs.
Conclusion

The described method allows you to register controls in one place for the entire project. Subsequent modification of this file requires less effort than if you had to do it in the usual way. Try using SSI #include inside the files you insert - this allows you to organize a kind of hierarchy and inheritance, which can be convenient for large projects

Every ASP.NET developer needs to be familiar with Page Directives. If you are a beginner and you want to learn about the Page Directives then you can read this article.

So the first question is about Page Directives.

What is a Page Directive?

Basically Page Directives are commands. These commands are used by the compiler when the page is compiled.

How to use the directives in an ASP.NET page

It is not difficult to add a directive to an ASP.NET page. It is simple to add directives to an ASP.NET page. You can write directives in the following format:

<%@%>

See the directive format, it starts with "<%@" and ends with "%>". The best way is to put the directive at the top of your page. But you can put a directive anywhere in a page. One more thing, you can put more than one attribute in a single directive.

Here is the full list of directives:

• @Page
• @Master
• @Control
• @Import
• @Implements
• @Register
• @Assembly
• @MasterType
• @Output Cache
• @PreviousPageType
• @Reference

Let's discuss something about each directive.

When you want to specify the attributes for an ASP.NET page then you need to use @Page Directive. As you know, an ASP.NET page is a very important part of ASP.NET, so this directive is commonly used in ASP.NET.

<%@Page Language="C#" AutoEventWIreup="false" CodeFile="Default.aspx.cs" Inherits="_Default"%>

Now you have some information about @Page Directives. The @Master Directive is quite similar to the @Page Directive. The only difference is that the @master directive is for Master pages. You need to note that, while using the @Master Directive you define the template page's property. Then any content page can inherit all the properties defined in the Master Page. But there are some properties that are only available in a Master Page.

<%@Master Language="C#" AutoEventWIreup="false" CodeFile="MasterPage1.master.cs" Inherits="MasterPage"%>

@Control

@Control builds ASP.NET user controls. When you use the directive you define the properties to be inherited by the user controls and theses values ​​are assigned to the user controls

<%@Control Language="C#" Explicit="True" CodeFile="WebUserControl.ascx.cs" Inherits="WebUserControl" %>

As you know you need to define namespaces in your .cs class before using a C# or VB class. So the @Import Directive imports namespaces. This directive supports just a single attribute "namespace" and this attribute takes a string value that specifies the namespace to be imported. One thing you need to note is that the @Import Directive cannot contain more than one attribute/value pair. But you can use multiple lines.

<%@Import Namespace="System.Data"%>

@Implements

The @Implements Directive gets the ASP.NET pages to implement .Net framework interfaces. This directive only supports a single attribute interface.

<%@Implements Interface="System.Web.UI.IValidator"%>

@Register

When you create a user control and you drag that user control onto your page then you will see the @Register directive. This directive registers your user control on the page so that the control can be accessed by the page.

<%@ Register TagPrefix="MayTag Namespace="MyName.MyNameSpace" Assembly="MyAssembly"%>

@Assembly

The @Assembly Directive attaches assemblies to the page or an ASP.NET user control thereby all the assembly classes and interfaces are available to the class. This directive supports the two attributes Name and src. The Name attribute defines the assembly name and the src attribute defines the source of the assembly.

<%@Assembly Name="MyAssembly"%>
<%@Assembly src="MYAssembly.cs">

@MasterType

The @MasterType Directive connects a class name to the ASP.NET page for getting strongly typed references or members contained in the specified Master Page. This directive supports the two attributes Typename and virtualpath. Typename sets the name of the derived class from which to get the strongly typed or reference members and virtualpath sets the location of the page from which these are retrieved.

<%@MasterType VirtualPath="/MasterPage1.master"%>

@output cache

It controls the output caching policies of an ASP.NET page.

<%@ OutputCache Duration ="180" VaryByParam="None"%>
@Previouspagetype

This directive specifies the page from which any cross-page posting originates.

@Reference

This directive declares that another page or user control shout be complied along with the active page or control. This directive supports the single attribute virtualpath. It sets the location of the page or user control from which the active page will be referenced.

<%@Reference VirtualPayh="~/MyControl.ascx"%>

Final Words

I hope you get some knowledge from here. Please comment about how you like this article. Your comments are very valuable for me, because only you will tell me where I am going wrong and what improvements I need to make to write a better article. Please comment and provide your feedback.

The Google search engine (www.google.com) provides many search options. All of these features are an invaluable search tool for a first-time Internet user and at the same time an even more powerful weapon of invasion and destruction in the hands of people with evil intentions, including not only hackers, but also non-computer criminals and even terrorists.
(9475 views in 1 week)

Denis Batrankov
denisNOSPAMixi.ru

Attention:This article is not a guide to action. This article is written for you, WEB server administrators, so that you will lose the false feeling that you are safe, and you will finally understand the insidiousness of this method of obtaining information and set about protecting your site.

Introduction

For example, I found 1670 pages in 0.14 seconds!

2. Let's enter another line, for example:

a little less, but this is already enough for free download and for guessing passwords (using the same John The Ripper). Below I will give some more examples.

So, you need to realize that the Google search engine has visited most of the Internet sites and cached the information contained on them. This cached information allows you to get information about the site and the content of the site without a direct connection to the site, just digging into the information that is stored internally by Google. Moreover, if the information on the site is no longer available, then the information in the cache may still be preserved. All you need for this method is to know some Google keywords. This technique is called Google Hacking.

For the first time, information about Google Hacking appeared on the Bugtruck mailing list 3 years ago. In 2001, this topic was raised by a French student. Here is a link to this letter http://www.cotse.com/mailing-lists/bugtraq/2001/Nov/0129.html . It gives the first examples of such requests:

1) Index of /admin
2) Index of /password
3) Index of /mail
4) Index of / +banques +filetype:xls (for france...)
5) Index of / +passwd
6) Index of/password.txt

This topic made a lot of noise in the English-reading part of the Internet quite recently: after an article by Johnny Long published on May 7, 2004. For a more complete study of Google Hacking, I advise you to go to the site of this author http://johnny.ihackstuff.com. In this article, I just want to bring you up to date.

Who can use it:
- Journalists, spies and all those people who like to poke their noses into other people's business can use this to search for compromising evidence.
- Hackers looking for suitable targets for hacking.

How Google works.

To continue the conversation, let me remind you of some of the keywords used in Google queries.

Search using the + sign

Google excludes unimportant, in its opinion, words from the search. For example, interrogative words, prepositions and articles in English: for example are, of, where. In Russian, Google seems to consider all words important. If the word is excluded from the search, then Google writes about it. In order for Google to start searching for pages with these words, you need to add a + sign before them without a space before the word. For example:

ace + of base

Search by sign -

If Google finds a large number of pages from which it is necessary to exclude pages with certain topics, then you can force Google to search only for pages that do not contain certain words. To do this, you need to indicate these words by putting a sign in front of each - without a space before the word. For example:

fishing - vodka

Search with the ~ sign

You may want to look up not only the specified word, but also its synonyms. To do this, precede the word with the symbol ~.

Finding an exact phrase using double quotes

Google searches on each page for all occurrences of the words that you wrote in the query string, and it does not care about the relative position of the words, the main thing is that all the specified words are on the page at the same time (this is the default action). To find the exact phrase, you need to put it in quotation marks. For example:

"bookend"

To have at least one of the specified words, you must specify the logical operation explicitly: OR. For example:

book safety OR protection

In addition, you can use the * sign in the search string to denote any word and. to represent any character.

Finding words with additional operators

There are search operators that are specified in the search string in the format:

operator:search_term

The spaces next to the colon are not needed. If you insert a space after a colon, you will see an error message, and before it, Google will use them as a normal search string.
There are groups of additional search operators: languages ​​- indicate in which language you want to see the result, date - limit the results for the past three, six or 12 months, occurrences - indicate where in the document you need to look for the string: everywhere, in the title, in the URL, domains - search the specified site or vice versa exclude it from the search, safe search - block sites containing the specified type of information and remove them from the search results pages.
However, some operators do not need an additional parameter, for example, the query " cache:www.google.com" can be called as a full search string, and some keywords, on the contrary, require a search word, for example " site:www.google.com help". In the light of our topic, let's look at the following operators:

Operator site: limits the search only on the specified site, and you can specify not only the domain name, but also the IP address. For example, enter:

Operator filetype: restricts searches to files of a certain type. For example:

As of the date of this article, Google can search within 13 different file formats:

• Adobe Portable Document Format (pdf)
• Adobe PostScript (ps)
• Lotus 1-2-3 (wk1, wk2, wk3, wk4, wk5, wki, wks, wku)
• Lotus Word Pro (lwp)
• MacWrite(mw)
• Microsoft Excel (xls)
• Microsoft PowerPoint (ppt)
• Microsoft Word (doc)
• Microsoft Works (wks, wps, wdb)
• Microsoft Write (wri)
• Rich Text Format (rtf)
• Shockwave Flash (swf)
• Text (ans, txt)

Operator link: shows all pages that point to the specified page.
It must always be interesting to see how many places on the Internet know about you. We try:

Operator cache: shows the Google cached version of the site as it looked when Google last visited the page. We take any frequently changing site and look:

Operator title: searches for the specified word in the page title. Operator allintitle: is an extension - it looks for all the specified few words in the page title. Compare:

intitle:flight to mars
intitle:flight intitle:on intitle:mars
allintitle:flight to mars

Operator inurl: causes Google to show all pages containing the specified string in the URL. allinurl: searches for all words in a URL. For example:

allinurl:acid_stat_alerts.php

This command is especially useful for those who don't have SNORT - at least they can see how it works on a real system.

Google Hacking Methods

So, we found out that, using a combination of the above operators and keywords, anyone can collect the necessary information and search for vulnerabilities. These techniques are often referred to as Google Hacking.

site `s map

You can use the site: statement to see all the links that Google has found on the site. Usually, pages that are dynamically created by scripts are not indexed using parameters, so some sites use ISAPI filters so that links are not in the form /article.asp?num=10&dst=5, but with slashes /article/abc/num/10/dst/5. This is done to ensure that the site is generally indexed by search engines.

Let's try:

site:www.whitehouse.gov whitehouse

Google thinks that every page on a site contains the word whitehouse. This is what we use to get all the pages.
There is also a simplified version:

site:whitehouse.gov

And the best part is that the comrades from whitehouse.gov didn't even know that we looked at the structure of their site and even looked into the cached pages that Google downloaded for itself. This can be used to study the structure of sites and view content without being noticed for the time being.

Listing files in directories

WEB servers can display server directory listings instead of regular HTML pages. This is usually done to force users to select and download specific files. However, in many cases administrators have no intention of showing the contents of a directory. This is due to a misconfiguration of the server or the absence of a master page in the directory. As a result, the hacker has a chance to find something interesting in the directory and use it for his own purposes. To find all such pages, it is enough to notice that they all contain the words: index of in their title. But since the index of words contain not only such pages, we need to refine the query and take into account the keywords on the page itself, so queries like:

intitle:index.of parent directory
intitle:index.of name size

Since most directory listings are intentional, you may have a hard time finding misplaced listings the first time. But at least you will be able to use the listings to determine the WEB server version, as described below.

Getting the WEB server version.

Knowing the WEB server version is always helpful before starting any hacker attack. Again thanks to Google it is possible to get this information without connecting to a server. If you look closely at the directory listing, you can see that the name of the WEB server and its version are displayed there.

Apache1.3.29 - ProXad Server at trf296.free.fr Port 80

An experienced administrator can change this information, but, as a rule, it is true. Thus, to get this information, it is enough to send a request:

intitle:index.of server.at

To get information for a specific server, we refine the request:

intitle:index.of server.at site:ibm.com

Or vice versa, we are looking for servers running on a specific version of the server:

intitle:index.of Apache/2.0.40 Server at

This technique can be used by a hacker to find a victim. If, for example, he has an exploit for a certain version of the WEB server, then he can find it and try the existing exploit.

You can also get the server version by looking at the pages that are installed by default when installing a fresh version of the WEB server. For example, to see the Apache 1.2.6 test page, just type

intitle:Test.Page.for.Apache it.worked!

Moreover, some operating systems immediately install and launch the WEB server during installation. However, some users are not even aware of this. Naturally, if you see that someone has not deleted the default page, then it is logical to assume that the computer has not been subjected to any configuration at all and is probably vulnerable to attacks.

Try looking for IIS 5.0 pages

allintitle:Welcome to Windows 2000 Internet Services

In the case of IIS, you can determine not only the version of the server, but also the version of Windows and the Service Pack.

Another way to determine the version of the WEB server is to look for manuals (help pages) and examples that can be installed on the site by default. Hackers have found quite a few ways to use these components to gain privileged access to the site. That is why you need to remove these components on the production site. Not to mention the fact that by the presence of these components you can get information about the type of server and its version. For example, let's find the apache manual:

inurl:manual apache directives modules

Using Google as a CGI scanner.

CGI scanner or WEB scanner is a utility for searching for vulnerable scripts and programs on the victim's server. These utilities need to know what to look for, for this they have a whole list of vulnerable files, for example:

/cgi-bin/cgiemail/uargg.txt
/random_banner/index.cgi
/random_banner/index.cgi
/cgi-bin/mailview.cgi
/cgi-bin/maillist.cgi
/cgi-bin/userreg.cgi

/iissamples/ISSamples/SQLQHit.asp
/SiteServer/admin/findvserver.asp
/scripts/cphost.dll
/cgi-bin/finger.cgi

We can find each of these files using Google, using the words index of or inurl in addition to the file name in the search bar: we can find sites with vulnerable scripts, for example:

allinurl:/random_banner/index.cgi

With additional knowledge, a hacker could exploit a script vulnerability and use the vulnerability to force the script to serve any file stored on the server. For example a password file.

How to protect yourself from being hacked through Google.

1. Do not upload important data to the WEB server.

Even if you posted the data temporarily, you can forget about it or someone will have time to find and take this data before you erase it. Don't do it. There are many other ways to transfer data that protect it from theft.

2. Check your site.

Use the described methods to research your site. Check your site periodically for new methods that appear on the site http://johnny.ihackstuff.com. Remember that if you want to automate your actions, you need to get special permission from Google. If you carefully read http://www.google.com/terms_of_service.html, then you will see the phrase: You may not send automated queries of any sort to Google's system without express permission in advance from Google.

3. You may not need Google to index your site or part of it.

Google allows you to remove a link to your site or part of it from its database, as well as remove pages from the cache. In addition, you can prohibit the search for images on your site, prohibit the display of short fragments of pages in search results. All options for deleting a site are described on the page http://www.google.com/remove.html. To do this, you must confirm that you are really the owner of this site or insert tags into the page or

4. Use robots.txt

It is known that search engines look into the robots.txt file at the root of the site and do not index those parts that are marked with the word Disallow. You can use this to prevent part of the site from being indexed. For example, to avoid indexing the entire site, create a robots.txt file containing two lines:

User-agent: *
disallow: /

What else happens

So that life does not seem like honey to you, I will say in the end that there are sites that follow those people who, using the above methods, look for holes in scripts and WEB servers. An example of such a page is

Appendix.

A little sweet. Try one of the following for yourself:

1. #mysql dump filetype:sql - search for mySQL database dumps
2. Host Vulnerability Summary Report - will show you what vulnerabilities other people have found
3. phpMyAdmin running on inurl:main.php - this will force close the control via phpmyadmin panel
4. Not for distribution confidential
5. Request Details Control Tree Server Variables
6. Running in child mode
7. This report was generated by WebLog
8. intitle:index.of cgiirc.config
9. filetype:conf inurl:firewall -intitle:cvs - maybe someone needs firewall configuration files? :)
10. intitle:index.of finances.xls - hmm....
11. intitle:Index of dbconvert.exe chats - icq chat logs
12. intext:Tobias Oetiker traffic analysis
13. intitle:Usage Statistics for Generated by Webalizer
14. intitle:statistics of advanced web statistics
15. intitle:index.of ws_ftp.ini - ws ftp config
16. inurl:ipsec.secrets holds shared secrets - secret key - good find
17. inurl:main.php Welcome to phpMyAdmin
18. inurl:server-info Apache Server Information
19. site:edu admin grades
20. ORA-00921: unexpected end of SQL command - get paths
21. intitle:index.of trillian.ini
22. intitle:Index of pwd.db
23. intitle:index.of people.lst
24. intitle:index.of master.passwd
25.inurl:passlist.txt
26. intitle:Index of .mysql_history
27. intitle:index of intext:globals.inc
28. intitle:index.of administrators.pwd
29. intitle:Index.of etc shadow
30. intitle:index.of secring.pgp
31. inurl:config.php dbuname dbpass
32. inurl:perform filetype:ini