Cult of the Dead Cow releases Google hacking tool

happygeek 0 544 Views

The Cult of the Dead Cow, the infamous hacking collective, has released a Google hacking utility called Goolag Scan that brings the ability to search the information engine for web-based data that is normally hidden to anyone wannabe with a web browser and half a brain. It does this by implementing something in the region of 1500 customised Google search routines to reveal application server passwords, credit card numbers, corporate email records and audit logs to name just a few examples. Sure, the ability to find this stuff is open to anyone using Google who knows what to look for and how to filter the results accordingly. Sure, the real problem is the companies who have not properly secured the data in the first place so making it available for such searching. But let's be honest, the Cult of the Dead Cow sure ain't helping matters.

"Advanced Google searching has been known about in security circles for some time, but it has been a highly specialised and technical topic that is definitely not for non-programmers" says Calum Macleod, European director at encryption experts Cyber Ark, who adds "A lot of companies protect their Web-based and Internet gateway- accessible data using ID and password systems, but the actual data pages are often unprotected. Even though the pages are not indexed in the standard sense, Goolag Scan can prise the data out into the open and allow standard keyword searching on those pages."

The Cult of the Dead Cow will say that it is releasing this utility, which has been in use within the group for three years apparently, in order to get people thinking about whether online data storage is a good idea, to get them thinking about web based security more seriously.

That sounds awfully akin to getting people to take road safety more seriously by providing imbecile joy riders with a tank and pointing them in the direction of a school at going home time…

Dani AI

Generated

The release referred to in this thread reopened a long‑running issue: search engines can act as reconnaissance tools, and packaging those queries into a simple scanner makes that reconnaissance easier for non‑experts. That point underpins both ’s worry that the tool amplifies risk and ’s suspicion that releases like this are partly PR for a group — both perspectives have history and coverage in trade press and in OWASP’s guidance on search‑engine reconnaissance. (See the contemporary reporting and the OWASP testing guidance.)
Computerworld coverage · OWASP testing guide: search engine reconnaissance

Practical short checklist for site owners and network ops:

  • Treat search engines as part of the attack surface: proactively search your domain (and known subdomains) for exposed content and sensitive filetypes rather than waiting to be found. Use curated dork lists for targeted checks.
  • Don’t rely on robots.txt to “hide” sensitive pages — it’s not a security control. For urgent removals, use Google’s Removals tool and then make the fix permanent (remove content, block access, or return 404/410). Also follow OWASP guidance to classify and protect sensitive data.
    GHDB / dork resources · Google: remove a page from Search · OWASP Top Ten / Sensitive Data Exposure

Quick workflow and tooling:

  • Schedule automated scans (server checks + web app scans) and follow up with manual review. Recommended, well‑maintained projects include OWASP ZAP for DAST and Nikto for server/config checks; combine these with code/config reviews and CI‑integrated checks. Remember: don’t run noisy automated queries against Google or third‑party sites (Google will rate‑limit/block aggressive scraping). Always test only systems you own or have explicit written permission to scan.
    OWASP ZAP info · Nikto

This is a reminder, not a scare: fix misconfigurations, remove exposed artifacts, monitor logs for discovery attempts, and bake search‑engine reconnaissance into regular security audits. The linked resources above are practical starting points.

Member Avatar for jwenting
jwenting 1,905 duckman

it's a group of computer criminals...
They're releasing it as a piece of advertising, trying to draw in buyers for their services.
If they're releasing what they've been using themselves before that only means they've got something more powerful already and/or have mined it dry themselves already so it's got no economic value left for them.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview