Principles and prevention of Google intrusion (1)

Today, we will share with you another feature of Google: using search engines to quickly search for vulnerable hosts and sensitive data, you can even directly intrude on dummies.

Use google for "penetration testing"

Today, penetration testers often collect information before launching attacks, and then identify and exploit vulnerabilities to expand the results. Here we want to talk about:

1. Use google to find the host with the php webshell backdoor installed and test whether it can be used.

2. Use google to find exposed INC sensitive information

OK. Now let's start:

1. Search for webshell using php

In the google search box, enter:

Code:

Intitle: "php shell *" "Enable stderr" filetype: php

(Note: intitle-the webpage title Enable stderr-UNIX standard output and the abbreviated filetype-file type for standard errors ). In the search results, you can find many web shells that execute commands directly on the machine. If the PHPSHELL you find won't be used, if you are not familiar with UNIX, you can directly look at the LIST, which is not detailed here and has a lot of useful value. It should be noted that some of the foreign phpshells we searched here use UNIX commands, which are all functions called by the system (in fact, Baidu and other search engines can be used, only fill in different search content ). Through my detection, this PHPWEBSHELL can directly Echo (commonly used Unix Commands ). In one sentence, the home page is settled.

Code:

Echo "summon"> index. jsp

In

Code:

Echo

Then write: "summon

Now let's look at the homepage and change it to "summon.

We can also use WGET to upload a file (for example, the leaf you want to replace ). Execute Command and enter cat file> index.html or echo ""> file

Echo "test"> file

In this way, the site homepage is replaced successfully. You can also

Code:

Uname-a; cat/etc/passwd

However, you must note that some WEBSHELL programs cannot be executed due to problems, such

Http: // *** www.al3toof.com/card/smal... c_html & command =

Http: // *** ramsgaard.net/upload/shell.php

Php on these sites is global register off

Solution

You can use related tools to search on the Internet. If any information is abused, go to http: // *** www.google.com/remove.htmlto submit the information you want to delete and control the search engine robot query.
2. Search for INC sensitive information

In the google search box, enter:

Code:

. Org filetype: inc

We are searching for the INC information of the site with the org domain name (because google has blocked the search for "COM" information, we can also search for other gov, cn, info, tw, jp, edu, etc.

PS: Many PHP programmers like to write some frequently written code or configuration information during programming. inc files, such as shared. inc, global. inc, conn. inc and so on. Of course, this is a good habit, including the official PHP website. But I wonder if you have noticed a security risk. I wrote a wrong sentence when I was writing a PHP code. When I checked this PHP file in a browser, I found that the page details the PHP file path and code line that I encountered an error. (PHP error shows that the configuration is on. This function is default in PHP !), This means that when we do not intend to write the error code (the same. the same is true for inc files) or PHP code parsing problems, and PHP error display is open, the client user will see the specific url address. inc file, and. the url file is like a txt file. When browsing in a browser, its content is displayed without reservation, and many sites are in. the inc file writes important information such as the user password! Including the well-known Haier and Jialing motorcycle companies in China, I dared to announce it because I tested http: // *** www.haier.com/su ***/inc/conn. the Database ID and password exposed by inc cannot be connected to the client, the website is disabled by 1215, And the firewall is filtered out.