Let’s dive deeper and see how hackers find vulnerable services, credentials or other hidden data
using Google dorks.This is information that has been accidentally exposed on the Internet and the most
of the time
it happened because of a misconfiguration of a server.
Google advanced operators can be used to exploit insecure services.
You can see a list with all Google operators here on this Wikipedia page.
These are all Google operators. Before continuing
I want to point out that you are not allowed to log into a device that requires a password,
even if that web password is shown in clear text. That is the line where it becomes illegal to access a
device that you don't have permission to use. All information shown in this video is for educational
purposes only.
Be aware that Google might start blocking your connection if you connect from a single static IP address.
Let's get started with some examples. In the next Google dork
I'll use two operators: "allintext" and "filetype". allintext:username filetype:log
"allintext" is a Google search operator used to search only in the body text of the documents while ignoring
links, urls, and titles. And the "filetype" type operator will limit the results to a specific file
type,
in this case to logtype.
See how Google is trying to block my connection.
I have to solve these captcha!
After solving the captcha we see a lot of information that has been probably accidentally exposed.
Let's see this one!
These are the logs of maria db server and if you are searching for words username or password you’ll
find a lot of exposed credentials in clear-text.
Many of the passwords are random strong passwords, but that’s of no help. Let’s see a Google Hacking query that
would find exposed PHPinfo files.
You should know that phpinfo() provides you complete information about PHP, the web server and other services
that are running on a server.
So filetype
:php inurl:info and I'm searching for "Php Credits" between double quotes "Configuration" and "Php Core"
Let's try some pages!
This is sensitive information exposed by mistake.
The next Google Dork will allow us to search for WordPress sites that have wp-content directory exposed.
inurl: wp-content and the / and then index of
And we see exposed directories!
This problem can be fixed by setting the correct directly permissions and disabling directory indexing.
By the way directory indexing is very important when running any type of a blog.
Let’s go ahead and see how different Apache HTTP servers are performing. intitle:
"Apache Status" inurl:server-status
If you include inurl in your query Google will restricted the results to documents containing that
word inurl. The Apache status module allows a server administrator to find out how
well the server is performing.
This is confidential information and should be available only to the admin.
This is how the servers are performing.
Let's move on and search for ftp servers that published files which are supposed to be internal but were
unwillingly made public intitle:"index of"
inurl:ftp ; these are the results!
Resources published by ftp probably by mistake!
If I want to see only the results that are published after year 2019 I can add the after
operator.
So after:2019
Let's try another one!
I’ll search for configuration files with passwords: filetype:env "DB_PASSWORD"
Configuration files should not be made public and .ENV files are a great example. These are simple configuration
text files that are used to define some variables you want to pass into your applications environment.
If we search for .ENV files that contain a string for the database password we instantly find the password
to the database we've discovered. Now let's find lists of emails! To find them
we'll be looking for a spreadsheet .XLSx file type with the string "email.xlsx" in the URL.
Like this!
These are all Excel files that contain emails.
Organizations are frequently exposing these lists by accident.