Sec?

Lets discuss Security

11  07 2007

Disguise yourself as Googlebot to browse Paysites

Fox under Sheep hood

I hope everyone has heard the story of fox under sheep hood in primary school, where fox wears a sheep skin to mingle among sheep and eat them without any suspicion. Well, same is the case with Googlebot disguise mechanism. But before getting into technical stuff, lets just look into WHY we need to disguise the browsers in the first place ?

Many websites and top forums for e.g. Webmastersworld have premium section’s where you need to pay or have need special rights to enter into those forums. But surprisingly enough, Google, the search engine giant can easily index all of those premium pages too. Does that mean Google signups (and pays) each of those sites?

NO !

The big brother has lot more important stuff to do than registering thousands of those forums or blogs. Actually, almost all of those sites have special setting on their server which allows all the HTTP_REQUEST from the major search engines (or bots) to read all of their files residing on the server irrespective of their content type [using robots.txt].

The following idea is actually exploitation of the same permission by disguising your browser into Googlebot [Google Search Engine indexing engine], so that those sites thinks your browser HTTP_REQUEST as Googlebots request and would easily allow to browse those privileged sections.

The parameter we have to change is called the User Agent. The user agent defines the browser and version that you use. For example it would show Internet Explorer as your browser if you are using this one.

You need to alter your settings to the following:

User Agent: Googlebot/2.1
Compatible: http://www.googlebot.com/bot.html

You can do so in Opera with ease. Firefox offers an extension which is downloadable from the official website.

For Internet Explorer you need to change registry entries.

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet Settings5.0User Agent] @="Googlebot/2.1" "Compatible"="+http://www.googlebot.com/bot.html"

Save this as ua.reg and execute.

To revert the changes back, you need the following:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet Settings5.0User Agent] @="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Save as oua.reg and execute.

Voila !

You can know browse those pay sites without paying single penny !

Note
All tips & tricks posted on this website is for fun & educational purpose only. Secinfinity bears no responsibility upon any damage caused by using those ideas.


Leave a Reply

« iPhone Hacked ! Lock your PC ! »