Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: InfoSec Handlers Diary Blog InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

When Google isn't Google

Published: 2013-06-10
Last Updated: 2013-06-10 12:22:43 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Like many other exploit scripts, the recent "Plesk" exploit used a fake user agent of "Googlebot". Attackers assume that most web applications are happy to be indexed by Google and possibly ably no or less stringent filters. For example, some applications will show more content to Google that is not readily displayed to normal users unless these users sign up, solve a captcha or even pay.

Google however makes it pretty easy to distinguish "real" Google bots from fake once. The IP address used by Google will reverse resolve to, where a-b-c-d is the IP address of the bot. In addition, this host name will resolve to the IP address used. In order to validate if a google bot is "real", the lookup against is required. An attacker could fake the reverse lookup if the attacker can provide reverse DNS for the IP address used by the attacker.

Personally, I use  a little shell script to extract "fake google" spiders from my logs:


# you may need to adjut the "cut" parameter and file name to match your own log format.
for b in `grep 'Googlebot' /var/log/httpd/*access_log | cut -f 2 -d' ' | sort -u`; do
  h=`host $b`
  if echo $h | grep -e ' crawl-.*\.googlebot\.com\.$'; then
    h=`echo $h | cut -f5 -d' '`
    n=`host $h | cut -f4 -d' '`
    if [ "$n" = "$b" ] ; then
      echo ok $n $h $b
      echo fake $b;
    echo fake $b;




Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: google webapp
1 comment(s)
Diary Archives