tailieunhanh - Google hacking for penetration tester - part 27

Định vị mục tiêu dễ bị tổn thương Những kẻ tấn công có thể xác định vị trí mục tiêu tiềm năng bằng cách tập trung vào các chuỗi trình bày trong cài đặt trình diễn một ứng dụng dễ bị tổn thương của cung cấp bởi nhà cung cấp phần mềm. | Locating Exploits and Finding Targets Chapter 6 261 Locating Malware 0 Google s binary search feature can be used to profile executables but it can also be used to locate live malware on the web. See . Moore s search engine at http research misc mwsearch. Locating Vulnerable Targets 0 Attackers can locate potential targets by focusing on strings presented in a vulnerable application s demonstration installation provided by the software vendor. 0 Attackers can also download and optionally install a vulnerable product to locate specific strings the application displays. 0 Regardless of how a string is obtained it can easily be converted into a Google query drastically narrowing the time a defender has to secure a site after a public vulnerability announcement. Links to Sites 0 research wikto Wikto an excellent Google and Web scanner. 0 code Nikto an excellent Web scanner. 0 http An excellent site for tools and exploits. 0 Ilia Alshanetsky http archives 0 Nitesh Dhanjani http archives 2006 10 using_google_ 0 Chris Shiflett http blog 2006 oct google-code-search-for-security-vulnerabilities 0 Stephen de Vries http archive 107 447729 30 0 Michael Sutton s Blog 0 http blogs msutton archive 2006 09 26 How- 0 http blogs msutton archive 2007 01 31 262 Chapter 6 Locating Exploits and Finding Targets 0 Jose Nazario s page on Google Code Search insecurity stats http jose blog page google_code_search_stats 0 Static Code Analysis with Google by Aaron Campbell http 2006 10 static-code-analysis-using-google-code-search 0 HD Moore s Malware Search http research misc