Notorious hacker group Cult of the Dead Cow (cDc) has released a web auditing tool which uses Google to find vulnerabilities on sites..

The group claims that the Goolag Scanner enables anyone to audit their own website via Google.

The scanner technology is based on 'Google hacking', a form of vulnerability research developed by a cDc member known as 'Johnny I Hack Stuff'.

Available as a downloadable application, Goolag makes use of 'dorks', or detailed search patterns that show untapped results for sites previously indexed by Google.

Dorks find results that might show information relevant to security issues and/or confidential data, and are not limited to Google's search engine, according to cDc.

However, the Goolag Scanner is focused on usability. It simplifies the use of myriad numbers of dorks to a few mouse clicks, and does not require cryptic command line options or knowledge of 'Google hacking'.

Goolag Scanner comes with its own dorks database, but it is not limited to this, essentially lowering the bar for would be hackers using dorks to scan sites for vulnerabilities.

"It is no big secret that the web is the platform, and this platform pretty much sucks from a security perspective," said cDc spokesman 'Oxblood Ruffin'.

"Goolag Scanner provides one more tool for site owners to patch their online properties. We've seen some pretty scary holes through random tests with the scanner in North America, Europe, and the Middle East.

"If I were a government, a large corporation, or anyone with a large website, I'd be downloading this beast and aiming it at my site yesterday. The vulnerabilities are that serious."

With Goolag, cDc appears to be repeating history by putting easy-to-use hacking tools into the hands of novices.

The group shot to notoriety during the 1990s with the release of the BackOrifice tools which allowed low-level users to hijack and take control of Windows PCs.

Copyright © 2009 vnunet.com