[TOOL] GoogleSweep - Google Information Gathering Tool

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  GoogleSweep - Google Information Gathering Tool
------------------------------------------------------------------------


SUMMARY



DETAILS

GoogleSweep is a pen-test tool for information-gathering that uses Google 
to find information on IP addresses and hostnames on a target network. The 
original purpose of GoogleSweep was to perform host-discovery in a 
stealthy manner by finding publicly accessible web logs, however, in some 
situations it can give clues about browsing habits, user and service 
enumeration, password policy, and much more.

Features:
GoogleSweep differs from other "Google Hacking" tools in that it is not 
intended as a vulnerability sweep, looking for known-vulnerable scripts 
and applications with "inurl:"-style queries. This tool performs simpler 
queries of IP addresses and host names on a subnet and displays the 
results in a way that a penetration tester or systems administrator can 
quickly see at a glance how much information about the target network is 
publicly accessible. While the hosts are displayed with graphs showing 
relative popularity on Google, the actual search results are the sort of 
thing that need to be parsed by a person. Preferably one with a brain. 
Some things you might find in the results are:

 * Hits to web sites - For whatever reason, a lot of web sites like to (or 
don't realize that they are doing it) publish statistics about their 
traffic, even so detailed as to include the IP addresses of visitors.

 * Mailing list posts - From list archives, often with full headers. 
Users, workstation IP addresses, mail servers, etc.

 * Guestbook entries, Forum posts, other Misc. web stuff

 * Site-specific documentation - Instructions for employees on how to log 
on, default passwords, password policy, etc.

Then again, you might not. It might miss your most important server, or 
find some old information that's not relevant anymore. That's up to you to 
sort out. Some other nice things about GoogleSweep:

 * Stealth - GoogleSweep is a good tool to run across a subnet first to 
discover active hosts and other information without interacting with the 
target network.

 * Report Generation - Generates HTML reports with a graph showing 
relative popularity and links to the query results. Also generates comma 
delimited output for use in your own scripts, spreadsheets, or databases.
  *  <http://cse.msstate.edu/~rwm8/googlesweep/sample.html> Sample HTML 
output
  *  <http://cse.msstate.edu/~rwm8/googlesweep/sample.txt> Sample comma 
delimited output

 * "Burst" mode - The Google API limits you to 1000 queries a day, which 
may not be sufficient for scanning large networks (or perhaps you want to 
save some queries for another program). This lets you do a specified 
number of queries, and then sleep until the next day and continue.

Requirements:
GoogleSweep has been tested on Python 2.4.1 with pygoogle 0.6 (along with 
the few things it depends on).

You will also need a Google API license, which you can learn more about 
here. They're free.

Once you get a hold of a Google API license, you'll want to put the key 
somewhere that pygoogle can find it. The easiest is to just have it in 
".googlekey" in your home directory, but other options are listed in 
pygoogle documentation.

GoogleSweep will chew through hundreds of your API queries, of which you 
are only alloted 1,000 a day, so keep that in mind.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Robert Wesley McGrew.
To keep updated with the tool visit the project's homepage at:  
<http://cse.msstate.edu/~rwm8/googlesweep/> 
http://cse.msstate.edu/~rwm8/googlesweep/



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.