10/21/2008

First steps to do before google hacking your site

The first thing you have to do is to set up a Google account for webmasters. If you make yourself member of Google than you can use the procedure to delete or change the cache or certain links in the Google results about your site. As long as you don't do that the Google index and cache will continue to show you the hacked pages of your site.

The second thing you have to do is to set up a robot.txt page. This robot.txt page tells Google which part of the website can be indexed and which not. You have to be careful although. Making this robot.txt page too obvious will make a Google search for such files like a discovery tour without any resistance.

The third thing you have to do is to change the banners of your hardware and software installations. You don't have to show in Google which version of software you are running so Google can show and tools can download all the sites that are vulnerable for a certain new (unpatched?) vulnerability. Also you should change all error pages and error handling to a general 404 page or to your homepage. Technical and errorinformation is not for your readers it is for your administrators.

The fourth thing you have to do is to place a security page on your website. The security page is a page in which you publish the technical contact for security questions, your privacy declarations and regulations and a responsable disclosure policy. In that policy you say that you want to work with people who have found vulnerabilities or problems and that if they aren't exploited and published you won't prosecute and that you will fix these problems together and attribute them if they want to and the operation is successful. Write also that you will complain against commercial enterprises that do vulnerability research and afterward want to sell a product and that those DO NOT fall under this responsable disclosure policy.

and last but not least, you should do this often just to be sure

And than you can start GOOGLE hacking .... to be continued

10:23 | Permalink | Comments (0) | Email this | |  del.icio.us | | Digg! Digg |  Facebook

Post a comment