Excellent tricks and techniques of Google Hacks ws_ftp.

ini is a configuration file for a popular FTP client that stores username s, (weakly) encoded passwords, sites and directories that the user can store for later reference. These should not be on the web! That's some good stuff. Just copy/paste the text into your own WS FTP ini file a nd you're good as gold (assuming you're using the same version). Don't forget even if they have taken the file offline, use the "cache:FULL_URL/wsftp.ini" to see the contents. probably one of the best exploits I have seen in a long time, when I did it ther e were about 20 vulnerable computers, just recently there was 4 so I hope whiteh ats got to this before anyone else. really nice !! To see results; just write in the (http://www.google.com/) search engine the cod e: intitle:index.of ws_ftp.ini ============================================== Frontpage.. very nice clean search results listing !! I magine with me that you can steal or know the password of any web site designed by "Frontpage". But the file containing the password might be encrypted; to decrypt the file download th e program " john the ripper". To see results; just write in the (http://www.google.com/) search engine the cod e: "# -FrontPage-" inurl:service.pwd ============================================== This searches the password for "Website Access Analyzer", a Japanese software th at creates webstatistics. To see results; just write in the (http://www.google.com/) search engine the cod e: "AutoCreate=TRUE password=*" ============================================== This is a query to get inline passwords from search engines (not just Google), y ou must type in the query followed with the the domain name without the .com or .net. To see results; just write in the (http://www.google.com/) search engine the cod e: "http://*:*@www" bangbus or "http://*:*@www"bangbus Or http://bob:bob@www Or http://admin:*@www

==============================================

This search is a cleanup of a previous entry by J0hnny. It uses "parent director y" to avoid results other than directory listings. WS_FTP.ini is a configuration file for a popular win32 FTP client that stores us ernames and weakly encoded passwords. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:ini ws_ftp pwd Or "index of/" "ws_ftp.ini" "parent directory" ============================================== Microsoft Frontpage extensions appear on virtually every type of scanner. In the late 90's people thought they where hardcore by defacing sites with Frontpage. Today, there are still vulnerable servers found with Google. An attacker can simply take advantage from administrators who 'forget' to set up the policies for Frontpage extensions. An attacker can also search for 'filetyp e:pwd users'. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:pwd service ============================================== Not all of these pages are administrator's access databases containing usernames , passwords and other sensitive information, but many are! And much adminstrated passwords and user passwords, a lot of emails and the such too To see results; just write in the (http://www.google.com/) search engine the cod e: allinurl: admin mdb ============================================== DCForum's password file. This file gives a list of (crackable) passwords, userna mes and email addresses for DCForum and for DCShop (a shopping cart program(!!!) . Some lists are bigger than others, all are fun. To see results; just write in the (http://www.google.com/) search engine the cod e: allinurl:auth_user_file.txt

============================================== This search brings up sites with "config.php" files. To skip the technical discu ssion, this configuration file contains both a username and a password for an SQ L database. Most sites with forums run a PHP message base. This file gives you t he keys to that forum, including FULL ADMIN access to the database. To see view the PHP files; there in lies the catch. Browsers are made to process the command s of PHP before display, so if no commands, nothing to show. You can't use that persay to get into the config file, but it would show potential threats if someo ne got into server anyway. (If that happens you're basically boned anyway, not m uch around that. To see results; just write in the (http://www.google.com/) search engine the cod e: intitle:index.of config.php By the way, to know how to view the PHP file contents, you can use this code: intitle:"Index of" phpinfo.php ============================================== These files contain ColdFusion source code. In some cases, the pages are example s that are found in discussion forums. However, in many cases these pages contai n live sourcecode with usernames, database names or passwords in plaintext. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:cfm "cfapplication name" password ============================================== FlashFXP offers the easiest and fastest way to transfer any file using FTP, prov iding an exceptionally stable and robust program that you can always count on to get your job done quickly and efficiently. There are many, many features availa ble in FlashFXP. The flashFXP.ini file is its configuration file and may contain usernames/passwo rds and everything else that is needed to use FTP. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:ini inurl:flashFXP.ini ============================================== The encryption method used in WS_FTP is _extremely_ weak. These files can be fou nd with the "index of" keyword or by searching directly for the PWD= value insid e the configuration file. There is an easy way to decrypt the hash, use the decryptor at: http://www.codebluehacks.com/Tools.php?ID=1 Or

http://www.hispasec.com/directorio/laboratorio/Software/ws_ftp.html To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:ini ws_ftp pwd ============================================== These files contain cleartext usernames and passwords, as well as the sites asso ciated with those credentials. Attackers can use this information to log on to t hat site as that user. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:log inurl:"password.log" ============================================== Web Wiz Forums is a free ASP Bulletin Board software package. It uses a Microsof t Access database for storage. The installation instructions clearly indicate to change the default path and filename (admin/database/wwForum.mdb). vendor: http://www.webwizguide.info/web_wiz_forums/ The forum database contains the members passwords, either encrypted or in plain text, depending on the version. Please note: this search is proof that results can stay in Google's index for a long time, even when they are not on the site any longer. Currently only 2 out o f 9 are actually still downloadable by an attacker. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:mdb wwforum ============================================== VNC is a remote-controlled desktop product. Depending on the configuration, remo te users may not be presented with a password. Even when presented with a passwo rd, the mere existance of VNC can be important to an attacker, as is the open po rt of 5800. To see results; just write in the (http://www.google.com/) search engine the cod e: "VNC Desktop" inurl:5800

By the way, New version of VNC changed title to VNC Viewer so now you can search for intitle:vnc.desktop inurl:5800 ============================================== linux vpns store their usernames and passwords for CHAP authentification in a fi le called "chap-secrets" where the usernames and the passwords are in cleartext. To see results; just write in the (http://www.google.com/) search engine the cod

e: inurl:chap-secrets -cvs ============================================== These lock files often contain usernames of the user that has locked the file. U sername harvesting can be done using this technique. To see results; just write in the (http://www.google.com/) search engine the cod e: "index of" / lck ============================================== A standard FTP configuration file that provides far too many details about how t he server is setup, including installation paths, location of logfiles, generic username and associated group, etc. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:conf inurl:proftpd.conf -sample ============================================== This search finds registry files from the Windows Operating system. Considered t he "soul" of the system, these files, and snippets from these files contain sens itive information, in this case usernames and/or passwords. To see results; just write in the (http://www.google.com/) search engine the cod e: filetype:reg reg HKEY_CURRENT_USER username