So those advanced search operators, you probably got a sense for just how really incredible and specific
you could be with your searches.
Well, if you are using those to attack someone, you're engaging in what's called Google Dorking.
And the search strings that you're using are called dorks.
By the way, dork here is just a substitute for hack.
So you'll often hear this is Google hacking.
And of course, it would be a hack that you're entering in.
Is Google aware of this?
Yes.
And they are you know, they didn't publish it, I'm sure.
But there is a database of the latest of these that we can keep an eye on.
This is a great source for the recommended best practice here of running these in reconnaissance against
your own websites.
Okay.
I'm being really silly here because this is clearly one of those areas where I need to just show you.
It's easier for me to show you what I'm talking about.
So here we are.
I've done a search for the Google hacking database.
And yeah, it's not from Google themselves.
It's from the good people at Exploit DB.
And this is a website and a product name, exploit hyphen DB that you're going to want to know.
So the Google hacking database or.
What does it do?
It gives us none other than a list of the latest and greatest Google dorks.
Notice this one right here.
Site gov.
Dot asterisk.
So it's going to grab any of the gov sites.
And in the title is going to be index of.
And then it's dot rather asterisk dot cs v.
So you're getting all these indexes.
Now what is that file containing juicy info.
Yikes.
So one of the things that you can do is you can grab this.
Of course you can, you know, copy it.
Right?
So you can go in and copy the Google dork and then you can run over to your own copy of Google.
And what you'll do is you can paste this in, but modify the parameters, of course.
So I might go against R.
Oh, how about we do academy?
Right.
So any prefixed side of academy and we're going to get these indexes.
And sure enough, a lot of times you'll see this is just sample information.
That's cool.
So it's great.
This was something that was fine for us to find, and I didn't want to find anything obviously sensitive.
But you get the idea you are going to be able to effectively perform these same sometimes, you know,
incredibly dangerous Google dorks.
This is something very, very important for us to know about.
There are Google dorks that have revealed key usernames and passwords that have then gotten people in
systems.
Of course.
Google dorks are very popular in the area of voice over IP fingerprinting, VPN fingerprinting.
There is lots of different fingerprinting techniques that can be assisted in this area.
I'm so glad you know about it now, and I'm so glad that you're going to be able to run Google dorks
against websites from a Penn State perspective.