Re: Anonymizing RFI Attacks Through Google

[Vincent Archer <varcher () denyall com>]

On Sat, Nov 25, 2006 at 01:01:54AM -0500, Dude VanWinkle wrote:
> On 11/25/06, endrazine <endrazine () gmail com> wrote:
> > this process of attack is a mere waste of time if one only reaches
> > anonymity : in order to
> > give google this new url to crawl, you'd have to either create a web
> > page that points to this
> > very page, or enter the url in the google database directly using their
> > form. None of those two
> > options are safer than attacking the website directly (google might vey
> > well log your actions),
> > so  what's the point ?
>
> a lot of people are used to seeing google spider tracks in their logs.
> anonymizing your attack via google may make the admin investigating
> the attack think that a malfunctioning web bot was responsible for the
> attack, or they may skim over the entire incident accidentally.

Even if you are aware of an attack, the Google bot will not tell you
where the attacking URL comes from. So, if you're investigating the
hack, you have no data; you need to get Google to cooperate with you,
so they can find where the URL came from, and then investigate from
there.

That adds Google as an additional cut-out and delays any investigation.

-- 
Vincent ARCHER
varcher () denyall com

Tel : +33 (0)1 40 07 47 14
Fax : +33 (0)1 40 07 47 27
Deny All - 23, rue Notre Dame des Victoires - 75002 Paris - France

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/