Gooscan-automated Google Hacking Tool

Whilst reading an article the other day I saw this mentioned and realized I haven't written about this yet either, although I have written about the similar tool goolag.

What is gooscan?

Gooscan is a tool that automates queries against Google search appliances, but with a twist. these maid are designed to find potential vulnerabilities on Web pages. think "CGI succeeded" that never communicates directly with the target Web server, since all queries are answered by a Google appliance, not by the target itself.

 

 

Who is it written?

Security rule sionals: this tool serves as a front-end for an external web server assessment and aids in the "information gathering" phase of a vulnerability assessment.

Web server administrators: this tool helps to discover what the web community may already know about you thanks to Google.

Is this tool legal?

FromGoogle TOS-"You may not send automated queries of any sort to Google's system without express permission in advance from Google ."

This means that you shoshould not use this tool to query Google without advance express permission. google appliances, however, do not have these limitations. you shoshould, however, obtain advance express permission from the owner or maintainer of the Google appliance before searching it
Any automatic tool for varous legal and moral reasons.

 

 

The author wrote this tool not to violate Google's Terms of Service (ToS ), but to raise the awareness of the Web security community that a TOS may not discourage the bad guys from writing and running a tool like this for malicious purposes. to that end, only use this tool to query _ appliances _ unless you are prepared to face the (as yet unquantified) Wrath of Google.

Why the proxy feature?

Companies can only reach the Internet by way of an internal proxy server. when conducting an authorized assessment, it may be necessary to bounce queries of a Web Proxy instead of off the Google appliance directly.

You can download gooscan V1.0 here:

Gooscan V1.0