digg

Facebook Connect Join Digg About
See the original image at theregister.co.uk

That Password-Protected Site Of Yours - It Ain't Protected

theregister.co.uk — It's one of the simplest hacks we've seen in a long time, and the more elite computer users have known about it for a while, but it's still kinda cool and just a little bit unnerving: A hacker has revealed a way to use Google and other search engines to gain unauthorized access to password-protected content on a dizzying number of websites.

Who dugg this? Made popular Aug 24, 2008

Digg DudeWhat is Digg?

Digg is a place for people to discover and share content from anywhere on the web. Digg surfaces the best stuff as submitted and voted on by the community. Take the Tour to learn more.

140 Comments

show profanity settings
expand all
  • DeathJux, on 08/24/2008, -5/+244You're a moron if you allow search engine bots access to otherwise password-protected areas of your site, unless the data you're "protecting" doesn't need to be protected at all, in which case you're an even bigger moron.
  • cvxdes1, on 08/24/2008, -4/+189you're ***** kidding me, right?

    http://www.bethebot.com
    I made that a year ago, hit the digg front page with it, and got banned from digg for it... also sold the site 4 hours after.
  • diemunkiesdie, on 08/24/2008, -4/+180He is a hacker because he knows how to use Google cache? Also, how is sharing this well known trick on a forum the same thing as announcing it to the public? Also, this trick does not apply to all password-protected sites, this is total FUD!
  • 89vision, on 08/24/2008, -10/+157This isn't anything new
  • NathanielJ, on 08/24/2008, -0/+125It pisses me off when newspapers/websites call someone a "hacker" for doing something like using Google Cache.
  • NathanielJ, on 08/24/2008, -7/+112OMG I HERD THAT PASSWORD PROTECTED SITES R BREAKABLE CUZ IF SOMEONE TAKES UR HARDDRIVE THEY HAVE UR COOKIES
  • Bbanda, on 08/24/2008, -2/+85thats not a hack... thats just google cache doing its job. Password protected forums are generally free to join if you take the 2 minutes to sign up.
  • m0jo, on 08/24/2008, -4/+721 - Change browser user agent to : Googlebot/2.1 (+http://www.google.com/bot.html)
    2 - ????
    3 - Profit
  • NathanielJ, on 08/24/2008, -1/+68You meant http://www.experts-exchange.com/

    But yeah, that is quite possibly the most annoying Google search result ever.
  • cvxdes1, on 08/24/2008, -2/+67Honestly, I'm not too sure. A week after that hit the front page, I couldn't log in anymore. I suspect the same may happen with this account soon enough.
  • facelesscoward, on 08/24/2008, -1/+57Oohhh, thanks. I've been looking for an expert to help me get a sex change.
  • skweezer, on 08/24/2008, -2/+52That makes me a 1337 H4CX0r
  • aDJsavedmylife, on 08/24/2008, -3/+52This is the oldest trick in the book there have hundreds articles on here about this.
    The article makes it out to be most ELITE UNDERGROUND HACKING THE PENTAGON ***** EVER.

    But the fact of the matter is that these sites allow google etc. to indiex their sites without a password for SEO purposes.

    Annoying article.
  • gbjxc, on 08/24/2008, -3/+51...I hate journalists.
  • SqlByte, on 08/24/2008, -3/+47why did you got banned from Digg ?
  • afx1, on 08/24/2008, -1/+32the hottest text-based porn sites around!
  • cvxdes1, on 08/24/2008, -3/+32Also - I must add.. the new owner sucks at maintaining sites. I just visited it, apparently he ***** up the height offsets, and widths of the iframe.
  • KlogereEndGrim, on 08/24/2008, -3/+29So... what porn sites will this get me into?
  • netneutrality, on 08/24/2008, -0/+26<meta name="robots" value="noarchive">

    Add that to the head section of your page to allow search engines to index the content but tell them not to show a cached version.

    Oldest topic ever.
  • martinc00, on 08/24/2008, -2/+27"I DONT KNOW WHAT WE'RE YELLING ABOUT?!"
  • Metasquares, on 08/24/2008, -1/+24If you let Google in but bar normal users, you're advertising something that doesn't exist as far as I'm concerned and deserve to have your "protection" broken.

    Search engines are for publicly-accessible content. Want your content to be private? Forego listing it.
  • zdiggler, on 08/24/2008, -9/+32So how do I get into to porn sites using google cache?
  • inactive, on 08/24/2008, -4/+27like http://expertsexchange.com
  • cvxdes1, on 08/24/2008, -1/+23Sadly, I only got $150, because I sold in a rush. The buyer then resold it for $500 a day after.
  • Mackofalltrades, on 08/24/2008, -7/+29Porn?
  • inactive, on 08/24/2008, -1/+21Most important question asked on Digg...someone answer
  • Cheesasaurus, on 08/24/2008, -1/+20With this technique I can totally HACK THE PLANET!
  • jessenoob, on 08/25/2008, -0/+19I put on my robe and wizard hat.
  • Narcism, on 08/24/2008, -1/+18ask a question, and scroll down to the bottom of the page...
  • Linkage155, on 08/24/2008, -0/+16Well thats simple then, just eat the cookies! its what I do
  • LazyTurtle, on 08/24/2008, -1/+15Well the site makes it sound like only the elite hackers know it, which is completely false. This has been out for a very long time and has been posted on many forums.
  • NathanielJ, on 08/24/2008, -0/+13That's great for Google Cache, but people can still view the page by altering their user agent info to googlebot, or by using a website like bethebot.com (posted above).

    If you want something password protected, don't let robots view it. Simple as that. If you want it password protected but indexed, then it doesn't need to be password protected and you're just alienating users from your website. No one likes signing up when they shouldn't have to.
  • Sarevok9, on 08/25/2008, -0/+13welcome to the internet, you must be new here.
  • habbofresh, on 08/24/2008, -0/+13Equally as irritating when users anoint themselves as hackers for discovering this.

    Then again these are the same ***** who believe that generating traffic with "ping -t" and repeatedly hitting F5 will take down a site.
  • EBorg, on 08/25/2008, -0/+13Yep.
    Its a lot like that.
    Donald.
  • kevisazombie, on 08/24/2008, -0/+13***** you should have held on to that
  • xkhaozx, on 08/24/2008, -0/+12People, just scroll down to the bottom and the answers are there! You don't even have to change the referrer!
  • netneutrality, on 08/24/2008, -0/+11Cringingly lame?
  • StevesJobs, on 08/25/2008, -0/+11Somebody respond
  • jessenoob, on 08/25/2008, -0/+11Sigh...*insert Picard facepalm ASCII*
  • Vokas, on 08/24/2008, -5/+17Oh thanks for the tip. I didn't realize that even though it said it in the description.
  • reecon, on 08/24/2008, -0/+10I think you're getting that confused with the Robots that will come in the night and eat all your pills.
  • ryan83189, on 08/24/2008, -0/+10Isn't there a user agent switcher that can mimic web crawlers? That would be easier and more useful.
  • inactive, on 08/24/2008, -1/+10So this is now known as hacking? Jesus ***** christ, I knew about this years ago... I MUST BE A HAXOR!!!!!
  • fLUx1337, on 08/24/2008, -3/+12You can get any expert-exchange.com answers easy without any so called "hacks" like this, just make sure google is your referrer:

    http://www.google.co.uk/search?q=Connection+refuse ...
    ...and click the first result

    Oh: "At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

    Start your 7-day free trial to view this Expert Comment or ask the Experts your question."

    ....but scroll to the bottom and your answers are there for you to see!

    Didn't used to be like this, but I guess they got scared of there shady tactics getting them banned from Google, which probably sends them most of their traffic!
  • inactive, on 08/24/2008, -0/+8the site also says that it only applies to certain sites who allow certain user agents to view the protected content.
  • SSUK, on 08/24/2008, -1/+10And several times in the article
  • digjam, on 08/25/2008, -0/+7Somebody ***** respond....
  • heyblue, on 08/24/2008, -1/+8Nicely done! How much did you get for the site?
  • inactive, on 08/24/2008, -0/+7you just need to scroll down.
  • Fetching more discussions...
    Show 51 - 100 of 148 discussions

  • Add a Comment

    Login or register to comment!
    Or, sign-in super fast with your Facebook account ...


© Digg Inc. 2009 — Content created and posted by Digg users is dedicated to the public domain | Terms of Use Updated | Privacy Policy
DIGG, DIGG IT, DUGG, DIGG THIS, Digg graphics, logos, designs, page headers, button icons, scripts, and other service names are the trademarks of Digg Inc.