Gooscan… Goo scanning???
I read a post about this Gooscan this morning. My first impression for this tool is basically should be something to do with Google. And further reading proved my point.
So what exactly is Gooscan…? Mm… how about Google Scan..? Will it be better?
Basically, it is an automated query tool against Google search appliance. These particular queries are designed to find potential vulnerabilities on web pages. Think “cgi scanner” that never communicates directly with the target web server, since all queries are answered by a Google appliance, not by the target itself.
But before we go into this tool and just launch the button, you may want to take a closer look on this: From Google ToS - “You may not send automated queries of any sort to Google’s system without express permission in advance from Google.”
This means that you should not use this tool to query Google without advance express permission. Google appliances, however, do not have these limitations. You should, however, obtain advance express permission from the owner or maintainer of the Google appliance before searching it with
any automated tool for various legal and moral reasons.
Of course, the author wrote this tool not to violate Google’s terms of service (ToS), but to raise the awareness of the web security community that a ToS may not discourage the bad guys from writing and running a tool like this for malicious purposes. To that end, only use this tool to query ‘appliances’ unless you are prepared to face the (as yet unquantified) wrath of Google.
So, use the tool with care please..
Here you go - Gooscan V1.0
Comments
Leave a Reply