Two main classes of vulnerabilities that Google hackers look for are
- known vulnerabilities and
- information disclosure vulnerabilities.
Known vulnerabilities are obvious. They are the advisories that stream down
from the mailing lists which hackers use to create Google queries to find
vulnerable servers.
Information disclosure vulnerabilities are a broader area
that encompass username and password disclosures, privilege problems, and
areas of the website that were never designed to be found.
While some of
these can be detected automatically with scanners, others are impossible to
find. When Google bots (and other search engine spiders) come to a website,
they have no idea what they are supposed to be able to get to. The crawlers
click on every single link they can find and index the data returned. In no
means are they meant to attack or find vulnerabilities on a site. Hackers then
come along and create queries to find the vulnerable websites. |
