Search Engines, Web Services and Social Networks

What it is

The cheapest and quietest way to learn about a target is to use public search tools. Search engines index pages, internet-wide scanners index devices, and social networks expose people.

Because the target never sees these requests, this is passive footprinting. The risk to the organization comes from what it, or its staff, has already put online.

How it works

Footprinting through search engines

Advanced operators narrow results to exactly the files and pages an attacker wants. Using them is called Google dorking, or Google hacking.

Operators can be combined, so one query can ask for spreadsheets on a single domain whose title contains a keyword. The Google Hacking Database (GHDB), maintained with Exploit-DB, is a catalog of such queries that find exposed login pages, configuration files and error messages.

A cached copy can show content that has since been removed. Google has retired some of these operators in recent years, such as cache:, but the exam courseware still lists them, so learn them anyway. Other search engines and dark web search tools may be used for the same purpose.

Footprinting through web services

Several services collect information about internet-facing systems or past versions of websites.

Shodan is often described as a search engine for devices rather than pages. A search can find webcams, industrial controllers or databases that were put on the internet without protection.

theHarvester collects email addresses, host names and sub-domains from public sources. Maltego draws links between people, domains and infrastructure, and Recon-ng is a modular framework for open-source intelligence work.

Open-source intelligence (OSINT) is the umbrella term for all of this: intelligence from publicly available sources.

Footprinting through social networking sites

Employees share more than they realize. Professional and personal sites show roles, projects, tools, the people they work with and sometimes photos of badges or screens.

Tools can search for the same user name across many sites, such as Sherlock, and people search tools can combine results from many profiles.

Defenses

• Train staff about what to post and to keep profiles private.
• Remove sensitive files from public sites and use robots rules only as a hint, never as protection.
• Review search results and Shodan entries for the organization's own addresses.
• Keep secrets out of code repositories and scan them for leaks.
• Write job advertisements that do not list every product and version.

A worked example

A tester searches for a company's PDF files on its own domain and finds an old guide that includes an internal host name and the model of the firewall. A job advertisement names the VPN product. Together these tell an attacker which product to look for and which version-specific weaknesses to try.

How the exam asks about this

• "Which operator limits search results to a single domain?" -> site:
• "A tester wants to find exposed webcams and databases by banner. Which service fits?" -> Shodan.
• "Which source shows earlier versions of a website?" -> The Wayback Machine, a web archive.