GHDB
GHDB (a.k.a. Google Hacking Database) is HTML/JavaScript wrapper application that uses advance JavaScript techniques to scrape information from Johnny’s Google Hacking Database without the need for hosted server side scripts.
Why this application is interesting you may ask? We are not hosing any server side scripts on our side, and Johnny’s johnny.ihackstuff.com does not provide any JSON export of the database either, how the heck we still manage to fetch the data? Well, we are using a PIPE which is entirely online based. Online services are very Web2.0 so expect to see more of them very soon. For Web based malware perspective, this means that they no longer need server side support.
You can use this tool as a browser based replacement of the cDc’s (cult of the dead cow) Goolag tool.
The project is now part of GNUCITIZEN’s Secapps application stack.
I think this example really highlights the dangers you have spent the last god-knows-how-many posts talking about – Same Origin Policy violations are so easy with JSON services developing before browsers have even had a chance to implement JSONRequest or similar. Not that that will necessarily fix anything – offsite script linking isn’t going to disappear – I guess we should all just agree – you are right and the way the web is heading this will only get worse.