I noticed someone retweeted my link for this project last week so thought I’d write a short post about it.

Back in December, I started a project on parsing the URLs produced by Google for searches and redirects. I presented my research in a SANS webcast back in May. You can watch it here.

I also released the Perl script (yes, I know), which can be found here. It requires installing a few libraries to run. I should probably convert it to Python so it can be better utilised but that requires learning Python…it’s on the to-do list.

The rationale behind the project was that there’s a lot of parameters, and I had found a number of different pieces of research across the Internet but didn’t have one place to put it all. By creating the script, I could store everything that I had learned (and forgotten, there’s a lot of parameters, and a lot of potential values for some of them) and pass it on to the community.

Some quick examples include the following:

1. Go to Google.com (I’ve found that the parameters here appear because of the redirect to the Australian Google page)

2. Click in the search box and type “Hello world”, hit enter to search (I use the -t option for this so that it presents a bit nicer)

3. Then click on the “Images” tab to change to an image search

If anyone has any questions about some of the Google queries that they’re seeing then let me know; I’m happy to have a look.

I’ve had a couple of people let me know how it was useful in their investigations and that made the project worthwhile.

And yes, I know my Paint skills are terrible 🙂