3 ms·

New indexed files by google every day.

• tonteldoos 12y ago
  I think you gave the game away right there. From an ethical point of view, if you can index these files, you can also automate contacting the site owners. Yes, users should use better passwords, but there is also an onus on system admins to at least TRY and keep information secure.
  • bubblicious 12y ago
    Yep, well like I said it's no huge secret and the code I wrote is really basic. So you think the only thing I should do is just automate contacting the site owners with the link to the sensible files that have been indexed?
  • tonteldoos 12y ago
    You might have to be somewhat selective though. Don't tell them that you can or have mined the passwords (some of them might decide that you 'hacked' them). Maybe point out that potentially sensitive files are popping up on google, and try and look as dumb as possible. Don't let on that you're automating this in any way. Having said that, I'm sure that there will be a number of admins and users that will be extremely grateful for this! I've sent similar emails in the past, and where you don't always get a reply spouting thanks (or a reply at all), you will likely notice the file not being available anymore.
    • bubblicious 12y ago
      That sounds like a good idea. How would you deal with files indexed on places where there is no organization behind?
    • tonteldoos 12y ago
      It depends on how much effort you want to go through. You could do a whois on the IP/domain, and contact the registered owner (if the information is available).
• sireat 12y ago
  ahh the good old looking for config.php etc trick