tailieunhanh - Google hacking for penetration tester - part 29

Thâm nhập (pen) xét nghiệm đôi khi coi như là hacker chuyên nghiệp kể từ khi họ đột nhập vào các mạng cơ bản của khách hàng trong một nỗ lực để xác định vị trí, tài liệu, và cuối cùng là giúp giải quyết các lỗi bảo mật trong một hệ thống hoặc mạng. | Chapter 8 Tracking Down Web Servers Login Portals and Network Hardware Solutions in this chapter Locating and Profiling Web Servers Locating Login Portals Locating Other Network Hardware Using and Locating Various Web Utilities Targeting Web-Enabled Network Devices 0 Summary 0 Solutions Fast Track 0 Frequently Asked Questions 281 282 Chapter 8 Tracking Down Web Servers Login Portals and Network Hardware Introduction Penetration pen testers are sometimes thought of as professional hackers since they essentially break into their customers networks in an attempt to locate document and ultimately help resolve security flaws in a system or network. However pen testers and hackers differ quite a bit in several ways. For example most penetration testers are provided with specific instructions about which networks and systems they will be testing. Their targets are specified for many reasons but in all cases their targets are clearly defined or bounded in some fashion. Hackers on the other hand have the luxury of selecting from a wider target base. Depending on his or her motivations and skill level the attacker might opt to select a target based on known exploits at his disposal. This reverses the model used by pen testers and as such it affects the structure we will use to explore the topic of Google techniques we ll explore in the next few chapters are most often employed by hackers the bad guys. Penetration testers have access to the techniques we ll explore in these chapters but in many cases these techniques are too cumbersome for use during a vulnerability assessment when time is of the essence. Security professionals often use specialized tools that perform these tasks in a much more streamlined fashion but these tools make lots of noise and often overlook the simplest form of information leakage that Google is so capable of revealing and revealing in a way that s nearly impossible to catch on the radar The techniques we ll examine here are used on a .