.

Google Code Search

<<

dean

Post Tue Oct 10, 2006 1:02 pm

Google Code Search

Hi All,

Has anyone had a chance to try out Google's new search?

http://www.google.com/codesearch

The search options are pretty extensive and can lead to some pretty, um interesting, search results.

Seeing as you can search specific portions of code it's a great tool for finding possible vulnerabilities.

Check out Michael Sutton's Blog for a few ideas on what to search for:
http://portal.spidynamics.com/blogs/msutton/

Cheers,
Dean
<<

skel

User avatar

Jr. Member
Jr. Member

Posts: 60

Joined: Wed Aug 30, 2006 11:31 am

Post Tue Oct 10, 2006 10:48 pm

Re: Google Code Search


Hackers find use for Google Code Search
Shortcut for vulnerability seekers (whatever their hat color)


October 06, 2006  (IDG News Service) -- Google Inc. has inadvertently given online attackers a new tool.

The company's new source-code search engine, unveiled Thursday as a tool to help simplify life for developers, can also be misused to search for software bugs, password information and even proprietary code that shouldn't have been posted to the Internet in the first place, security experts said Friday.

Unlike Google's main Web search engine, Google Code Search peeks into the actual lines of code whenever it finds source-code files on the Internet. This will make it easier for developers to search source code directly and dig up open-source tools they may not have known about, but it has a drawback.

"The downside is that you could also use that kind of search to look for things that are vulnerable and then guess who might have used that code snippet and then just fire away at it," said Mike Armistead, vice president of products with source-code analysis provider Fortify Software Inc.

Attackers could also search code for vulnerabilities in password mechanisms, or to search for phrases within software such as "this file contains proprietary," possibly unearthing source code that should never have been posted to the Internet.

Security experts say that the security implications of Google Code Search are noteworthy, if not earth-shattering.

Skilled hackers may already be able to do this type of search with Google's Web search engine, but Code Search is "another tool that makes it a tad easier for the attacker," said Johnny Long, a security researcher with Computer Sciences Corp, in an e-mail interview.

For its part, Google did not have much to say about possible misuse of its new product. "Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement.

Google has never said much about the steps it takes to cut down on this kind of misuse of its search engine, though the issue comes up from time to time. In July, Websense Inc. used a little known binary search capability within Google Inc.'s search engine to look for malware on the Internet.

While Google Code Search will probably not have much of an effect on popular open-source projects, which are already heavily scrutinized, it could help ferret out vulnerabilities in lesser known pieces of code, according to Lev Toger, a software developer with Beyond Security Ltd.

"Using Google's code search, it's much easier to find interesting code portions," he said via e-mail. "If your task is to find vulnerability in some random code, this filtering can save you a lot of time. "


from http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9003938
Skel
<<

ryan.cartner

User avatar

Newbie
Newbie

Posts: 20

Joined: Tue Aug 15, 2006 12:26 pm

Post Thu Oct 12, 2006 7:16 am

Re: Google Code Search

using google code search, someone found a copy of the MS-DOS 6.0 Source Code. Mirrored here:

http://www.nurs.or.jp.nyud.net:8080/~nn ... e.Code.zip
<<

dh1mcp

User avatar

Newbie
Newbie

Posts: 1

Joined: Mon Jul 31, 2006 1:54 am

Location: Locator: JN58WE

Post Thu Oct 12, 2006 8:10 am

Re: Google Code Search

nice search for sql-queries (and injection-possibilities)
select\s.+from\s.+where lang:jsp

1st hit is
---snip---
where products.subjectid = " + request.getParameter("BrowseSubjectID");
---snap---

*going to look further*
-- 
dh1mcp
OCA

Return to Network Pen Testing

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software