Using Search Engines as Penetration Testing Tools

Search engines are a treasure trove of useful sensitive facts, which hackers can use for their cyber-attacks. Superior news: so can penetration testers. 

From a penetration tester’s place of perspective, all research engines can be mainly divided into pen test-unique and typically-utilised. The post will include 3 look for engines that my counterparts and I extensively use as penetration testing applications. These are Google (the typically-applied) and two pen check-distinct kinds: Shodan and Censys.

Google
Penetration tests engineers employ Google superior look for operators for Google dork queries (or only Google dorks). These are search strings with the subsequent syntax: operator:look for expression. Even more, you’ll find the list of the most valuable operators for pen testers:

• cache: delivers accessibility to cached pages. If a pen tester is seeking for a particular login webpage and it is cached, the expert can use cache: operator to steal person qualifications with a website proxy.
• filetype: limitations the search consequence to distinct file varieties. 
• allintitle: and intitle: both equally offer with HTML web page titles. allintitle: finds internet pages that have all of the research terms in the site title. intitle: restricts results to those that contains at minimum some of the look for phrases in the web site title. The remaining conditions really should show up someplace in the human body of the web site.
• allinurl: and inurl: apply the same principle to the website page URL. 
• web-site: returns outcomes from a internet site found on a specified domain. 
• connected: lets locating other web pages very similar in linkage styles to the specified URL. 

What can be located with Google state-of-the-art research operators?
Google advanced look for operators are utilized alongside with other penetration screening instruments for nameless facts gathering, community mapping, as well as port scanning and enumeration. Google dorks can supply a pen tester with a large array of sensitive info, this kind of as admin login pages, usernames and passwords, sensitive documents, armed service or govt facts, company mailing lists, bank account facts, etc. 

Shodan
Shodan is a pen check-unique look for motor that can help a penetration tester to locate precise nodes (routers, switches, desktops, servers, etc.). The search engine interrogates ports, grabs the ensuing banners and indexes them to uncover the demanded details. The value of Shodan as a penetration screening tool is that it supplies a amount of hassle-free filters:

• nation: narrows the research by a two-letter state code. For case in point, the ask for apache country:NO will clearly show you apache servers in Norway.
• hostname: filters effects by any portion of a hostname or a domain identify. For example, apache hostname:.org finds apache servers in the .org domain.
• web: filters success by a distinct IP range or subnet.
• os: finds specified functioning methods.
• port: lookups for unique solutions. Shodan has a restricted assortment of ports: 21 (FTP), 22 (SSH), 23 (Telnet) and 80 (HTTP). Nevertheless, you can deliver a request to the search engine’s developer John Matherly by means of Twitter for a lot more ports and companies.

Shodan is a industrial task and, although authorization isn’t required, logged-in people have privileges. For a regular monthly payment you will get an extended selection of question credits, the capability to use country: and internet: filters, conserve and share queries, as very well as export outcomes in XML format. 

Censys
A different helpful penetration screening instrument is Censys – a pen test-unique open up-source search engine. Its creators claim that the motor encapsulates a “complete databases of almost everything on the Web.” Censys scans the internet and gives a pen tester with three information sets of hosts on the public IPv4 deal with room, web-sites in the Alexa major million domains and X.509 cryptographic certificates.

Censys supports a whole text research (For illustration, certificate has expired query will give a pen tester with a list of all gadgets with expired certificates.) and common expressions (For illustration, metadata. Manufacturer: “Cisco” question shows all active Cisco products. Heaps of them will surely have unpatched routers with acknowledged vulnerabilities.). A far more comprehensive description of the Censys research syntax is offered listed here.

Shodan vs. Censys
As penetration testing applications, the two look for engines are utilized to scan the web for vulnerable systems. Even now, I see the variance in between them in the usage plan and the presentation of lookup effects.

 
Shodan does not demand any evidence of a user’s noble intentions, but one particular should shell out to use it. At the exact same time, Censys is open up-supply, but it requires a CEH certificate or other document proving the ethics of a user’s intentions to raise sizeable usage limits (accessibility to supplemental options, a question restrict (five for each day) from a single IP handle). 

Shodan and Censys current search outcomes in another way. Shodan does it in a far more easy for customers sort (resembles Google SERP), Censys – as uncooked information or in JSON structure. The latter is extra acceptable for parsers, which then present the information and facts in a more readable form.

Some stability researchers assert that Censys provides superior IPv4 deal with place coverage and fresher results. Yet, Shodan performs a way much more detailed online scanning and presents cleaner benefits. 

So, which just one to use? To my intellect, if you want some the latest data – select Censys. For everyday pen testing functions – Shodan is the proper choose.

On a ultimate take note
Google, Shodan and Censys are effectively really worth including to your penetration screening instrument arsenal. I endorse applying all the three, as every single contributes its component to a extensive information gathering.

Qualified Moral Hacker at ScienceSoft with 5 years of working experience in penetration screening. Uladzislau’s spheres of competence include reverse engineering, black box, white box and grey box penetration tests of website and mobile apps, bug looking and analysis perform in the area of details security.