Dorking your way in!

Google Hacking is evergreen topic in Cyber Security. They said if you can’t use google at his best you are not really a hacker.

Before we go in depth on this topic, let me clear some basic things about “Google Hacking.”

Google hacking is a term defined by Jonny Long, the maintainer of the Google hacking database.

Google hacking is best known as “Google Dorking”. It’s not a hacking of a google infrastructure and google products or their subsidiaries.

Google hacking is an Information Gathering technique which is helpful to find sensitive files or sensitive information exposed on the internet.

So, if you are wondering that, “is dorking works on other search engines?” The answer would be “yes”!

It doesn’t matter if you use google.com or duckduckgo.com, you will get results according to your queries.

Basically, using dorking you can find Vulnerabilities on web applications and on servers with the help of almost any search engines.

Well, you can’t hack sites directly using Google, but as it has tremendous web-crawling capabilities, it can index almost anything within your website, including sensitive information. This means you could be exposing too much information about your web technologies, usernames, passwords, and general vulnerabilities without even knowing it.

Apart from the search engines you can do some dorking in GitHub for sensitive information. We will see dorks for that later in this blog.

Be aware that Google also knows who you are when you perform this kind of query for this reason and many others, it’s advised to use it only with good intentions.

Also Google will start blocking your connection if you connect from a single static IP. It will ask for captcha challenges to prevent automated queries.

To take a note, GitHub dorks works differently than google dorks.

Operators and How to use them!

There are number of google dorks available which you can use to get juicy information.

Here’s how you put your query in search box

Operator: Search Term

· Inurl: It will search the specified keyword in URL.

Ex: target.com inurl:admin

· Allinurl: This is similar to above with a difference of multiple keywords you can use in a single query.

Ex: target.com allinurl:wp-content/plugins/wptf-image-gallery/

· Intext: It will search for specific text on a webpage.

Ex: target.com intext:Table structure for table `wp_users`

· Allintext: searches for multiple specific text contained on web page

Ex: target.com allintext: /iissamples/default/

· Intitle: It will search for various keywords inside the title of the HTML page.

Ex: target.com intitle:Index of /__MACOSX ...

· Filetype: It will query for certain file type

Ex: target.com filetype:csv

· Ext: it is similar to filetype.

Ex: target.com ext:sql

· Site: It will show you results just for mentioned website

Ex: site:target.com

· Cache: This will show you cached version of any website.

Ex: cache:target.com

· Link: This will show the list of web pages that have links to the specified URL.

Ex: link: facebook.com

· *: This works as a wildcard, which can be used to find the pages that contains anything before your word.

Ex: How to * a cake.

· |: This is a logical operator which works like a “or”.

Ex: intitle:"NetCamSC*" | intitle:"NetCamXL*" inurl:index.html

· +: this is used to concatenate two words.

Ex: inurl:8080 intext:"httpfileserver 2.3"

· –: This is used to query a negative search.

Ex: jdbc:mysql://localhost:3306/ username password ext:yml | ext:java -git –gitlab

Using above dorks for better results

• Let's say you want to find a log file of a firewall system which has a title “firewall.log” on page. The following dork will be useful for finding such files.

intitle:"index of" "firewall.log" | "firewall.logs"

Some of the “intitle” and “allintitle” dorks which worth of looking

intitle:"Index of /" .htaccess.old

intitle:"Wing FTP Server - Web"

allintitle: \"index of/admin\"

• Another example of a great dork, to find exposed git directory is following

inurl: /.git

"Reflector Dashboard" inurl:/db/index.php/

allinurl:index.php?db=information_schema

Combining dorks for better results.

• Let’s say you want to find passwords in a log file

allintext:password filetype:log

Some other dorks which combined with other operators to make it more powerful.

filetype:env "DB_PASSWORD"

allintext:username,password filetype:log

intext:"wordpress" filetype:xls login

Finding live webcams

intitle:"webcamXP 5" inurl:8080 'Live'

intitle:"WEBCAM 7 " -inurl:/admin.html

intitle:"EvoCam" inurl:"webcam.html"

Using ext operator with other operators,

"spring.datasource.password=" "spring.datasource.username=" ext:properties -git -gitlab

"db.username" "db.password" ext:properties

GitLab ssh.log ext:log

Database:phpmyadmin intext:mysql ext:sql inurl:phpmyadmin

Using filetype operator with other operators,

intitle:"index of" inurl:/*sql* filetype:log

s3 site:amazonaws.com filetype:xls password

filetype:svn -gitlab -github inurl:"/.svn"

inurl:/php-errors.log filetype:log

GitHub Dorking:

GitHub dorking is similar to google dorking with a difference of,

Google dorks searches on whole internet which also includes GitHub whereas GitHub dorks only searches on publicly available GitHub repositories. You can also search for code within a particular repository or organization.

You can normally find sensitive files, API keys, Passwords, Customer data, subdomains, sensitive urls while doing GitHub Dorking.

The format is similar to the google dork

Operator keyword

Let’s say you want to find a specific file on GitHub. You can use following dork for that.

Filename .bash_profile

The above dork will find all “.bash_profile” files available on GitHub. Now you want to reduce your searches to specific things. Say you want to find passwords in “.bash_profile” so you can use,

Filename .bash_profile password

There are couple of things you can do with “filename”,

filename:.env DB_USERNAME

filename:.esmtprc password

filename:credentials aws_access_key_id

There is one option which you can use to search a term in specific programming language file,

language:sql username

language:java api key

language:shell secret

You can also find data using specific extensions,

extension:sql mysql dump

extension:json api.segment.io

extension:yaml mailchimp.com

Disclaimer:

This blogspot is written for those who have no idea and/or new to the information security. The information shared in this blog are only for educational purpose.

Author and Secure Logic aren't in charge of any and have/has no responsibility for any kind of:

· Malicious act, capable of causing damage to any organizations using above information.

References:

All dorks are taken from exploit-db and credit goes to the original authors.

https://www.bugcrowd.com/resources/webinars/github-recon-and-sensitive-data-exposure/