A group of hackers known as “Cult of the Dead Cow” recently released a Google Web auditing scanner that allows users to search a specific website or domain for exploitable flaws through the search engine. The tool, known as the Goolag Scanner, is intended for website owners to audit their own web pages.
The Goolag Scanner is a standalone Windows GUI-based application, and is grounded in Google scanning technology developed by a well-known hacker that goes by the name “Johnny I Hack Stuff.” Goolag is open-source and freely available for download under the GNU Affero public license.
The Goolag scanner works by sending the same queries to Google as a user would from a browser. Shipped as a Windows .NET program, it can be configured to power 1,500 embeddable Google queries for servers or an entire domain set. It then scans the pages, looking for misconfigured web servers with open backdoors, sensitive usernames and passwords, and a host of other vulnerable information.
Because Goolag is an automated program, it may run into some problems. For one, you’ll only be able to run a few queries at a time. Google has made efforts to detect and deny automated searches, which will limit the number of queries one can run. You may also run the risk of being recognized as an automated tool, and could potentially have your IP address shut down.
