[tyingq]

Prompted me to do a little experimentation with google query parameters. Some potentially concerning stuff out there...

This one seems offline, but a typical example:

ftp://asapdata.arc.nasa.gov/incoming/BOB/HyspIRI/data-bob/00_README.MASTERweb_updating.txt

  3. Login to MASTER database:
    http://asterdb.jpl.nasa.gov/log/dbstart.asp

  a. User: eric; Password: Upd8t3r

[mkagenius]

Would you mind sharing the google query? Getting to this with a google query seems magical!

[tyingq]

https://www.exploit-db.com/google-hacking-database/ gives some more tips.

[rollulus]

"user * password *" site:nasa.gov filetype:txt

[chris_wot]

And I just stumbled upon this:

http://www.nackerhews.com/item?id=11549946

But that's pretty bad!

[davesque]

Maybe it's on their intranet? It doesn't seem to be accessible.

[davesque]

Nevermind, just got to it :P.

[chris_wot]

Are you sure that's a good idea? This seems to be something to do with flight paths and the Ames research centre...

[davesque]

Didn't log in. Don't want to. Just wanted to see if the URL returned anything.

[mpnordland]

Seems like it's working to me, what do you mean by offline?

[chris_wot]

And all of a sudden the FBI has a lot of IP addresses to follow-up...

[mpnordland]

I should note that I did alert the sysadmin and he told me he was taking it down and would figure out how to secure it.