untangling_the_web

DID: 4046925
UNCLASSIFIEDifl-6R 6FFl6IAL b1&1i g~L.Y
~ personal and/or financial information
~ userids, computer or account logins, passwords
~ private, confidential, or proprietary company data
~ sensitive government information
~ vulnerabilities in websites and servers that could facilitate breaking into the
site
Now, you may be thinking to yourself, "I use Google all the time and I've never
encountered this type of information." That's not surprising. It's not usually the kind
of thing you would stumble across inadvertently. Normally, one would have to be
actively looking for this type of information. Of course, many of the documents
Google hackers find using these techniques are not sensitive and indeed are
intended for the public Internet. Only a tiny fraction of the over eight billion pages in
the Google index were not meant to be made available to the public. And, it so
happens, these techniques are excellent unconventional ways of finding useful
information that might not be discovered using routine search engine queries. Here
are some of the typical techniques used in Google hacking:
~ search by file type 63 , site type, and keyword: many organizations store
financial, inventory, personnel, etc., data in Excel spreadsheet format and
often mark the information "Confidential," so a Google hacker looking for
sensitive information about a company in South Africa might use a query such
as:
[filetype:xls site:za confidential]
a similar but more specific search could involve use of a keyword such as
budget to search for Excel spreadsheets at Indian websites; for example:
[filetype:xls site:in budget]
~ one of the most popular Google hacking technique is to employ stock words
and phrases such as proprietary, confidential, not for distribution, do not
distribute, along with a search for specific file types, especially Excel
spreadsheets, Word documents, and PowerPoint briefings.
~ search for files containing login, userid, and password information; note,
even at international sites, these terms usually appear in English. This type of
information is typically stored in spreadsheet format, so a typical search might
be:
[filetype:xls site:ru login]
63 It is critical that you handle all Microsoft file types on the Internet with extreme care. Never open a
Microsoft file type on the Internet. Instead, use one of the techniques described here.
UNCLASSIFIEDHFOR OFFIGIAL l:ISE 6NLY 177