How to avoid people hacking your site with the help of GOOGLE

[yoyoyoyo]

http://johnny.ihackstuff.com/index.php?module=prodreviews

This link is not put here as a means to teach you how to compromise anyone else's website- it is presented here in hopes that you will keep your site more secure, and avoid some of the traps listed on that site.

SEE BELOW (POST # 7 IN THIS THREAD) FOR TOOLS TO HELP COUNTER THESE TYPE OF HACKERS

[AN-net]

maybe sending this to the dev's at vb.com would be better>_> so they can plug wholes within the software instead of helping roaming hackers find a good resource to do some hacking on others sites.

[yoyoyoyo]

Originally Posted by AN-net

maybe sending this to the dev's at vb.com would be better>_> so they can plug wholes within the software instead of helping roaming hackers find a good resource to do some hacking on others sites.

I will forward it to them as well, but I see no reason to deny anyone any knowledge, especially if they can use it to protect themselves.

KNOWLEDGE IS POWER

If the hackers know how to do stuff like that, then website owners should also know what they are capable of, and how to counter it. I don't think that anyone here wants to end up on their page of example sites.

EDIT: I changed the link to a URL within code tags, to avoid unlicensed people from seeing the link. Anyone who is licensed will only be interested in protecting their site with this info.

[twoseven]

just a note anyone can google that info and come up with a site displaying it

[AN-net]

looking at the queries on google they run, it makes me want to remove my version number from public display

[Brad]

Originally Posted by AN-net

looking at the queries on google they run, it makes me want to remove my version number from public display

I've been doing this for years now, no point in anyone knowing what version I'm on.

[yoyoyoyo]

Here are tools to help with the fight against these type of hackers:

http://ghh.sourceforge.net/

GHH is the reaction to a new type of malicious web traffic: search engine hackers. GHH is a ?Google Hack? honeypot. It is designed to provide reconaissance against attackers that use search engines as a hacking tool against your resources. GHH implements honeypot theory to provide additional security to your web presence. 
     
Google has developed a powerful tool. The search engine that Google has implemented allows for searching on an immense amount of information. The Google index has swelled past 8 billion pages [February 2005] and continues to grow daily. Mirroring the growth of the Google index, the spread of web-based applications such as message boards and remote administrative tools has resulted in an increase in the number of misconfigured and vulnerable web apps available on the Internet.
     
These insecure tools, when combined with the power of a search engine and index which Google provides, results in a convenient attack vector for malicious users. GHH is a tool to combat this threat.

GHH emulates a vulnerable web application by allowing itself to be indexed by search engines. It's hidden from casual page viewers, but is found through the use of a crawler or search engine. It does this through the use of a transparent link which isn't detected by casual browsing but is found when a search engine crawler indexes a site. The transparent link (when well crafted) will reduce false positives and avoid a fingerprint of the honeypot.
             
The honeypot connects to a configuration file, and the configuration file writes to a log file which is chosen during configuration. The log file contains information about the host, including IP address, referral information, and user agent.
             
Using the information gathered in the log file, an administrator can learn more about attackers doing reconnaissance against their site. An administrator can cross reference logs and view a better picture of specific attackers.

GHH can be a minimum of 3 files, including the honeypot, the configuration file, and the log. The transparent link is made into a pre-existing webpage

[AN-net]

cool link but it does seem not to follow all of googles guidelines>_>

[Stachel]

Originally Posted by Brad

I've been doing this for years now, no point in anyone knowing what version I'm on.

How ?

[Brad]

Originally Posted by Stachel

How ?

Edit the phrase 'powered_by_vbulletin' in the admincp, remove this bit of text:

Version {1}

If you have tourble doing this please post a new thread in the General vBulletin Questions forum as this is not a support forum