Create Initial Ssn with airSlate SignNow

Cc ssn field

hi we're going to look at one of the most powerful hacking tools on the Internet today it's the Google web search now you make me a promise when you watch this video that if you find anything that is sensitive information that you do not use it in an illegal manner so you'll see what I mean as we go along so the website that we have in front of us here is called the Google hacking database it's an open source project that you can get in many different websites but I'm looking here at exploit dashdb.com now these are all different Google searches that will lead you to places that you did not know existed on the Internet people share data that they did not intend to and hackers use that data to find exploits and backdoors into systems where they're not invited so let me show you where the secret lies for this type of hacking so I'm going to google.com and doing a forward slash advanced underscore search so an advanced search allows you to find specific file names specific directories and names and words on a page that are things that are on web servers around the world and of course Google has spidered and looked into every nook and cranny of the Internet so it's going to find something in most cases so you can use the advanced search form here or there is a syntax of learning how to use these things so let me demonstrate so let's say I'm looking for a news story on Donald Trump so I'm looking at a website now I'm looking for a Donald Trump and Twitter so if I open up this I'm going to find twitter.com of course as my first search what if I only wanted to know what certain news organizations said about it what I could do then is put in an extra word here site colon and let's see if cnn.com gives us any specific information so now you can see that the search results start with cnn.com and every story from then on is on their website so that's how you narrow your search for site so that's one of the first keywords that you can use for an advanced search let's try another one I'm going to type in in URL this time and the word songs so now you can find that the URL is going to have the word songs in it so you can see up here the URL if I click this it'll have the actual words songs right there now anytime that you're looking for a specific URL you can do this in something that is really not that dangerous here like the word songs but let's think of another one so let's look at some examples of what an in URL search would do so if you look at some of these searching examples here you'll find in URL or in title so looking down through the list I find one that says in URL called password reset so I'm gonna right click and choose do this search so search Google for this word what comes up so password reset dot PHP is now going to be every one of these pages so let's just check one of these out I don't have any idea if this is going to be a useful website for a hacker or not but we'll find out when we get to the page though we can see that we are at a password request so this would be one place that you would go if you are a hacker and you said I need to find any page that has a password reset page now here's another idea called in title so let's take a look at this first one called index of admin config let's do a search for that so a Google search for this one looks like this in title colon index of and then there's another specific string called admin slash config so you can see this is really specific kind of searching now what does this bring to us let's click one and find out isn't that interesting so now we are in a website that obviously was not meant for the public to see and we have ourselves a bunch of files here and one of these if you got lucky would have a configuration file with a password in it or maybe some backups that would be from a previous version of the website and so anything that has a folder called admin or a folder called config is probably a sensitive directory and they might not want you there now as I look through this that really doesn't seem to be anything that is specifically secure however let's go back and check out the second one here called the index of system slash config what will that bring us alright let's try the Westgate mat Manor let's see what's going on in there oh nothing there so they have an empty folder but obviously they didn't want us there there's no reason for us to be in this folder but Google brought us here let's try the second one and what is mission safety don't look up there there's a config Inc PHP that sounds interesting what happens when I click that it appears like there's nothing on that file either but I would imagine with some luck I would be able to come through and find something along the way that would be helpful oh look at here here's a backup it looks like so we are in a bunch of system config and there's a bunch of files that are like compressed tar balls and we can open those up with like WinZip or something and maybe there's a password inside of those so this is kind of a search the directories where you don't belong kind of an exercise but the point is if you are a hacker you're going to eventually find the needle in the haystack if you're the system admin you shouldn't be putting these files on your web server in the first place Google's gonna find them here's an interesting line to put in let's search for in text so this means somewhere on the page there has to be a folder or a line called parent directory so a parent directory might just bring up the word parent directory on the page however if you put something else in there like in in text and then you put in a specific thing like I'm gonna put in a square bracket and put mp3 and let's see what that brings up so now we have a folder of files that's really what it is so let's uh let's pick the second one here it looks like I've been here before and what does mp3 at Queen directory look like well look at here we have files from all of the Queen recordings from the gerak group so do you want to download these you just right-click and save them they're all there so why did they publish them on their web server obviously they're not supposed to but now you can get to them now the parent directory look is looking at right here this is this is the keyword so if I click on parent directory I should be able to go and find other things so this looks mostly Russian and there are all kinds of artists as we go through so there's more stuff here than just the Queen music here's another search so let's say I'm going to put in in text : parent directory again and this time I'm looking for the office and I want to have mp4 files so that should bring up a bunch of files and sure enough look at this this is the office if you like the TV series they have mp4 files and if we click here we'll get the first one and it looks like to me it's gonna work so here we come with Aaron just going into the office and you can either watch or download them okay so that's a way to find things that have been posted on someone's web server and probably weren't meant to be shared with everybody else here's an interesting search I typed in in title so the title of the page is going to have index of again and this time I'm going to have admin slash backup that could be interesting let's see what the first link brings to us so a backup well it looks empty so sometimes you don't get anything the next one do we have anything in this backup nope so their folders are sometimes just folders let's look down further I think I found something in this site here and sure enough we have a backup and it looks like it's being run on a daily basis so May 27th was the last one let's let's download something here I'm gonna download Wednesday zip now I've got their entire web server probably a zip file let's go and open that up so let's go show in the finder so let's go open up this Wednesday zip and let's see what there might be so here comes their backup and it is a sequel file isn't that interesting the sequel file let's see what is in their sequel file so they're backing up their database and we have a table called achievements I wonder if they have another table called maybe let's do a search and users oh look at there there is a table called users we're gonna create the table and this table has a password item in it and it looks to me like every single user has been backed up isn't that nice we can see their password it looks like it's a hashed password probably oh that we can tell what category they belong to they are staff members I wonder if they have any admins we can look at there there's an admin and is phone number look at all of this stuff so don't put your backups online because people are like me are gonna come and find them now the point of this lesson isn't for you to be able to go find these and exploit them the point of the lesson is that if you're doing an administrative job you shouldn't be putting backups in your server folders here's another interesting URL that we could search for so if I searched for in URL : TS web now what does that stand for so terminal server web is what that is so if you wanted to find somebody that is going to have a remote desktop login they're going to put it on a server T a terminal server and let's say this one looks like you need to have a username and then you can choose the screen size and then connect so I don't really have a username for write networks but if I wanted to I could probably find some file and maybe that would be a point to get into their network so you can search for different places where you can log in let me show you another search so this one says I want to search for file types that a sequel extension that sounds like a backup and I want to look for the phrase called insert into and then I need to find one of these three words so let's see their past passwd or password and let's see what we find here so here's something from a university it looks like and we are going to open up a sequel file so this all looks like the last one we built so we are going to insert a bunch of users and see what do we have here so we've got somebody called jury team and public and there is their password jury team in public so they didn't hide their URLs very well and now I have a bility to log in to their website as an admin let's look at the first link that if that second one was interesting what's this one have to say so here is another link that tells us about looks like a database so we are inserting something here an item I'm probably interested in something called the users what do we get here so there it is we've got users the table there's the users table and sure enough we're inserting a bunch of data into the users table so I'm not going to just browse and look for passwords here but they're probably there in clear text so there is another example of how you can use Google to do your hacking for you I'm going to show you something where you can check to see if you've been hacked so I'm gonna go to pastebin.com so paste bin is a website that allows people to share text so for instance I tell you a whole story I type a bunch of junk or maybe a couple of passwords or maybe serial numbers Social Security numbers credit card numbers I don't know what I'm going to do but I'm gonna paste something here and then I'm just gonna say I want to share this with a buddy so I'm gonna choose create a new paste what does it do you can see that it generates a unique URL so some kind of a number appeared and now if I shared this link with you with a phone a text message or an email you can come in here and then you can copy the letters right out of this so what's what's the advantage here well a lot of criminals use paste bin to share data let me show you what I mean so I'm gonna type in the word site and paste bin and then I'm going to have the word MX as part of the text from the paste bin website so every every link on the Google search now comes from pastebin.com let's look at the first link so this here is a bunch of stolen credit cards so it came from March 15th of 2019 so you can guarantee that these were stolen there's a whole bunch of them here and you can also guarantee that these are all cancelled by now because people figured out that their credit cards were swiped and they probably had unauthorized charges so this is how people probably sell their credit card numbers someone says hey give me you know give me a dollar for these 10 credit card numbers that I've gotten and you can try to get any information out of them some of them are still active but anyway you can do American Express you can put in the word let's see let's try Visa is there any visa cards oh look at there there's a Visa card holder and here's a whole bunch of information it tells you who the card belongs to and their expiration date everything like that wow that's pretty amazing let's type in maybe SSN what does that do for you social security number so I'm not gonna go in there I don't want to really mess around on people's social security numbers but obviously other people have here's another thing you can do put in put in your name so I don't know this is scary I'm gonna put in my name Schlueter does anything come up thank goodness it's this it looks like there aren't any match is that they come up there so nobody has been using Schlueter as one of their paste bin searches yeah so there you go that is another tool that allows you to look into the criminal world and see if anyone's been looking at your information or stealing your information let me show you another paste bin let's put in this one here if I typed in a bunch of hyphens and then I typed in begin private key what in the world would that bring to us so a private key do you know what that means it's from a it's from somebody's encryption routine so pretty good privacy is the program that most people would work with if you want to have absolutely secure communication you have a private in a public key and you never want to share your private key with anyone so why is it here on paste bid I have no idea why they put it here but if you knew who this person was and you had a reason to intercept one of their communications you would be able to decrypt everything that they've sent so you're begin private key is an interesting phrase to search for now we can go on and on and find different things about this but I'm going to just point you to this google hacking database and there are 5,000 660 entries in the database and they're categorized so if you say I like that sensitive directories idea let's click on the link here and you can see that all of these searches will take you to a sensitive piece of data that usually people don't want you to find and so like symphony and what do we have do we have a Joomla some somewhere around here I thought or maybe just other different frameworks of web web development tools that are probably listed here so you will you will have to know the technology really well to know where people put their directories this is an interesting category it's called files containing juicy info and so you can see that we would have users dot JSON isn't that an interesting one or user data JSON now the point of learning these hacking tools isn't to make you a criminal the point is that you can do really stupid things if you are an administrator and you don't lock down your directories so for instance all those config files all those password directories all those backups they should be stored somewhere other than the directory where you're publishing things online so if you are managing a website put in your own information and see if you can find data about your own website and if it is open to the public you're probably not the first one to find it so use this as a tool to make yourself more secure by getting them view from the other side