tailieunhanh - Google hacking for penetration tester - part 30

Chú ý rằng các phần của trang báo lỗi được dán nhãn rõ ràng, làm cho nó dễ dàng để chuyển thành Google biến TITLE , thể hiện ở gần đầu danh sách, cho thấy rằng các văn bản sẽ được hiển thị trong tiêu đề của trình duyệt "đối tượng không tìm thấy!" bar. Khi tập tin này được xử lý và hiển thị trong một trình duyệt Web, nó sẽ giống như hình . | Tracking Down Web Servers Login Portals and Network Hardware Chapter 8 291 a href -- echo encoding url var HTTP_REFERER -- referring page a seems to be wrong or outdated. Please inform the author of a href -- echo encoding url var HTTP_REFERER -- that page a about the error. -- else -- If you entered the URL manually please check your spelling and try again. -- endif -- include virtual include ----------en-- Notice that the sections of the error page are clearly labeled making it easy to translate into Google TITLE variable shown near the top of the listing indicates that the text Object not found will be displayed in the browser s title bar. When this file is processed and displayed in a Web browser it will look like Figure . However Google hacking is not always this easy. A search for intitle Object not found is too generic returning the results shown in Figure . Figure Error Message Text Is Not Enough for Profiling 292 Chapter 8 Tracking Down Web Servers Login Portals and Network Hardware These results are not what we re looking narrow our results we need a better base search. Constructing our base search from the template files included with the Apache source code not only enables us to locate all the potential error messages the server is capable of producing it also shows us how those messages are translated into other languages resulting in very solid multilingual base searches. The file listed previously references two virtual include lines one near the top include and one near the bottom include .These lines instruct Apache to read and insert the contents of these two files located in our case in the var www error include directory into the current following code lists the contents of the file and show some subtleties that will help construct that perfect base search dd dl dl dd -- include virtual . -- dd dl h2 Error -- echo .