2.3 Google hacking / Dorking

Module2 – Footprinting. Section 2.3: Google hacking/Dorking Google hacking also named Google dorking, is a computer hacking technique that uses Google Search and other Google applications to find security holes in the configuration and computer code that websites use. • Finding Resources Using Google advance search operators • Expose hidden information • Google Hacking Database (GHDB) Google Dorking history In 2002 Johnny Long began to collect interesting Google search queries that uncovered vulnerable systems, sensitive information which he labeled them as googleDorks. • Hackers for Charity http://www.hackersforcharity.org/ GHDB is an authoritative source for querying the Google search engine • After Johnny Long, GHDB is now maintained by Offensive Security https://www.exploit-db.com/google-dorks/ Lets explore https://www.exploit-db.com/google-dorks/ Search the Google Hacking Database or browse GHDB categories Google Hacking Database (GHDB) identifies • Advisories and server vulnerabilities • Error messages that contain hacking info • Expose sensitive directories/password files • Pages containing logon portals • Sensitive directories • Vulnerable files, Vulnerable servers • intitle:admin filetype:php • intitle: “index of” finance.pdf • filetype:bak url:”htaccess|passwd|shadow|htusers” • "#-Frontpage-" inurl:administrators.pwd • filetype:log inurl password login • inurl:"ViewerFrame?Mode=“ • intitle:index.of mp3 • index of /htdocs • inurl:pictures intitle:index.of • inurl:_vti_pvt/administrators.pwd cbtu