WEBVTT - This file was automatically generated by VIMEO

0
00:00:09.300 --> 00:00:12.700
It's time for the 6th demo. Let me

1
00:00:12.700 --> 00:00:15.400
 show you how you can use Google hacking to

2
00:00:15.400 --> 00:00:18.300
 find insecure HTTP web pages.

3
00:00:20.100 --> 00:00:23.500
The web application is hosted on the domain hacking

4
00:00:23.500 --> 00:00:25.100
 web applications.com.

5
00:00:26.300 --> 00:00:30.100
I want to check if Google indexed insecure

6
00:00:29.100 --> 00:00:32.400
 HTTP web pages in this

7
00:00:32.400 --> 00:00:33.200
 web application.

8
00:00:34.200 --> 00:00:37.700
For this purpose. I will use the following Google

9
00:00:37.700 --> 00:00:39.200
 search engine query.

10
00:00:40.400 --> 00:00:43.100
site hacking web applications.com

11
00:00:43.900 --> 00:00:47.000
and minus sign in

12
00:00:46.700 --> 00:00:49.100
 URL https

13
00:00:50.400 --> 00:00:53.400
The queries starts with site hacking web

14
00:00:53.400 --> 00:00:56.800
 applications Comm because the web application

15
00:00:56.800 --> 00:00:58.600
 is hosted on this domain.

16
00:00:59.500 --> 00:01:03.100
Next you can see the logical operator and

17
00:01:02.100 --> 00:01:05.600
 after The Logical

18
00:01:05.600 --> 00:01:09.400
 operator and there is minus sign

19
00:01:09.400 --> 00:01:12.000
 in URL https.

20
00:01:13.100 --> 00:01:16.600
This way I am asking Google to return

21
00:01:16.600 --> 00:01:19.500
 index the web pages that are

22
00:01:19.500 --> 00:01:22.900
 not protected by secure https.

23
00:01:24.100 --> 00:01:28.000
In other words, I am asking Google to return

24
00:01:27.400 --> 00:01:30.600
 indexed web pages that

25
00:01:30.600 --> 00:01:34.000
 are available over insecure http.

26
00:01:35.500 --> 00:01:38.500
Okay. Now you understand how this

27
00:01:38.500 --> 00:01:40.800
 Google search engine query works.

28
00:01:41.500 --> 00:01:43.400
So let me copy this query.

29
00:01:44.400 --> 00:01:47.700
Let me paste it in Google search and let's

30
00:01:47.700 --> 00:01:50.500
 see if Google indexed web

31
00:01:50.500 --> 00:01:54.100
 pages available over insecure HTTP

32
00:01:53.100 --> 00:01:56.500
 on the domain hacking web

33
00:01:56.500 --> 00:01:57.700
 applications.com.

34
00:02:00.400 --> 00:02:04.300
Please notice that one insecure HTTP

35
00:02:03.300 --> 00:02:06.800
 web page has been indexed by

36
00:02:06.800 --> 00:02:07.200
 Google.

37
00:02:08.200 --> 00:02:09.800
Let's see this web page.

38
00:02:11.800 --> 00:02:14.400
There is an HTML form

39
00:02:14.400 --> 00:02:18.200
 with sensitive data and the sensitive

40
00:02:17.200 --> 00:02:19.700
 data is as follows.

41
00:02:20.500 --> 00:02:23.600
full name email phone and

42
00:02:23.600 --> 00:02:24.100
 password

43
00:02:25.500 --> 00:02:28.700
What's more in the URL bar? You

44
00:02:28.700 --> 00:02:31.400
 can see a padlock crossed out

45
00:02:31.400 --> 00:02:34.600
 with a red line and it means that

46
00:02:34.600 --> 00:02:38.200
 this web page is available over insecure

47
00:02:37.200 --> 00:02:38.900
 http.

48
00:02:39.800 --> 00:02:43.000
That's why the sensitive data entered into

49
00:02:42.400 --> 00:02:45.800
 this HTML form will be

50
00:02:45.800 --> 00:02:48.700
 sent over insecure HTTP, which

51
00:02:48.700 --> 00:02:52.000
 is just plain text. And obviously this

52
00:02:51.100 --> 00:02:54.300
 is not good from security point of

53
00:02:54.300 --> 00:02:54.500
 view.

54
00:02:55.500 --> 00:02:58.700
So as you can see Google hacking can

55
00:02:58.700 --> 00:03:02.000
 help you find insecure HTTP web

56
00:03:01.300 --> 00:03:04.400
 pages and this is what I presented

57
00:03:04.400 --> 00:03:06.200
 to you in this demo.

58
00:03:07.300 --> 00:03:07.600
Okay.

59
00:03:08.600 --> 00:03:11.700
Now we are done with this demo. So let

60
00:03:11.700 --> 00:03:14.300
 me jump to the next clip and let me

61
00:03:14.300 --> 00:03:17.300
 tell you about Google hacking database.