I have to admit it. I was not sure if I wanted to publish this technique or not. But when I saw how many businesses are affected by this backdoor issue, I decided to go ahead.
Some clarifying points:
First of all, this is a dirty technique; well, extremely dirty. But isn’t spying on your competitors dirty anyways?
Second, I am suggesting a fix for it, so you can repair the backdoor to your site (if needed be).
Third, all the information comes from a public source (Google’s index) but I think it’s business owners’ fault and not Google’s, for letting confidential documents being indexed by search engines.
The hack described below can give you access to your competition’s confidential documents, if they’re hosted on a public web server. We’ll use Google’s magic search operator site
Check if your competitors documents are indexed by Google with:
site:competitor.com filetype:pdf
site:competitor.com filetype:eps (for print material)
site:competitor.com filetype:ppt (for power point presentations)
site:competitor.com filetype:doc
for more file types see Google’s filetype command help http://www.google.com/help/faq_filetypes.html.
No results? Try all of the following queries
site:competitor.com inurl:assets
site:competitor.com inurl:clients
site:competitor.com inurl:documents
site:competitor.com inurl:confidential
site:competitor.com inurl:management
You could the searches above at once with “site:competitor.com inurl:assets OR inurl:clients OR inurl:documents OR inurl:confidential OR inurl:management”, but I would do each search separately and then go thru each page anyway.
Already peeking in? :) Well, there’s even more. Sometimes, when you find a .pdf file, let’s say, www.competitor.com/assets/hotleads_08.pdf, try to navigate to www.competitor.com/assets/. Some directories will not be protected and maybe you’ll get even luckier.
So, what if you’re affected by indexing problem too? Scary, isn’t it?
I don’t know excatly how Google is indexing such pages (I guess, links from emails in Gmail or GTalk internal communications, or whatever the reason), but I’ll tell you how to fix it.
In your .htaccess file you need to restrict the access to confidential directories with a password using the .htpasswd file. There may be other methods also, but here’s how you can do it: http://www.apluskb.com/scripts/How_do_I_secure_subdomain_answer2152.html
If your confidential files are already indexed by Google I recommend making an exclusion request on Google Webmaster Tools ASAP.
I also recommend not having important document on a public server, like your web server. If you still want to access them online, buy a dummy domain name, and password secure the root directory.
Rate This Post
GD Star Rating
loading...