Pete Finnigan's Oracle Security Weblog

I was reading the pen-test mailing list from security focus last night and found a post in a thread titled "Class on Security Tools". The post that took my eye is a post by Todd. The reason this took my eye is in the second paragraph where he talks about the new trend of using google for hacking. He goes on to say that google is used by hackers and penetration testers to find out huge amounts of data about a site that is to be hacked or about a client that is being audited. Todd also states that there is a tool called Wikto that has google hacking features. He also says that there is a new book about hacking with google.

I searched Amazon for this book and found a book called Google Hacking for Penetration Testers written by Johnny Long. This sounds a very interesting book. The author explores how to use google to find hidden information about a site, break into sites and find ways to access information that is supposed to be secure. The book is very useful for those people who are interested in making sure that their company or site does not leak this information into the Internet. The book will be on my shopping list of security and general books to buy once we get Christmas over with.

The subject of information leakage via websites, newsgroups, mailing lists, even on the internal intranet is something all users of Oracle databases and the data stored in them should b concerned about. I talked about this very subject in a recent blog entry here.

Hacking google or indeed any of the search engines to find hidden data or data that would help a hacker break into your company and steal your data is a real threat and one that should be taken into account when you are devising or revising your company security policies.