Google Hacking Guide
Google Hacking Guide
Resource from
By Ken Foster – KMBL Security
For educational purposes only.
Not for use in matters or on sites you are not
implicitly and legally approved to research
By Ken
Foster – KMBL Security
What is Google hacking?
The purpose of Google Hacking
is to leverage the vast amounts of data that are stored and indexed in search
engines to produce unique results that quickly identify sensitive information,
vulnerable systems, and network tactics and methods used by their hosts. These methods are beneficial to security
professionals, ethical hackers, and unfortunately black hats.
Who is Google Hacking?
Google hacking has become very
popular among security testers, ethical hackers, and unfortunately script
kiddies and hackers who all too well understand its value.
Is it Illegal?
This is debatable and dependent
upon the country or state you live in and the location of the target. As a standard practice you should never use
these techniques against a target that you do not have written permission from
the owner.
What do will I Need?
A web browser, an internet
connection, and a word processing program to save useful results for later
review and analysis.
Will the Target Know What I am Up to?
Just as a Hacker can perform
these queries against the target, so can Google capture the query results and
report them through mechanisms such as Google Alerts and Google Analytics. Additionally access to resources that are
derived from these searches may be logged by the hosts’ security systems, which
may indicate your reconnaissance.
Let’s try something Simple…
Let run a search for all the
phone number listed on the Stanford University Public Web Site. We would do this using a specially tailored
search phrase. In google query languard,
just like SQL database language, there are key words. One such key word is the term intext:,
which tells the search engine to review
the collective text of the indexed page and search for the search term that
follows. For example the results of intext: 650723 provides us access to a
broad listing of Stanford staff and instructor phone numbers, most with emails
as well. How did we decide to use the
search term 650723. By going to the home
page of Stanford University, we were able to locate the Area code (650) and
Phone exchange prefix (723) used by the
University. Since most large
organization utilize the entire prefix (the three numbers following the area
code), this simplifies our efforts.
What is you don’t have the time or want to write Google Query Language
Calls?
If you are in a
hurry, no worries use the Google Advanced Search page to get your
information. Up until recently this was
easily accessible. Now you must know the
pages address in order to access the page.
Your best course of action is to bookmark the below address:
“http://www.google.com/advanced_search?hl=en”. The Advanced Search page will allow you to
mix a combination of key words, phrases, and disqualifier words into a very
complex query. In addition you can force
the domain or site in which to narrow the results and even a specific type of
file you may be seeking. Using our
example from earlier, let’s say we wanted to find the phone numbers of Stanford
Professors that worked in IT
related fields. Using the Advanced
Search page we could build a query like:
professor "Phone" "Computer"
IT OR "Information Technology" OR IS site:Stanford.edu
![](file:///C:/Users/Student/AppData/Local/Temp/msohtmlclip1/01/clip_image004.gif)
Which would return focused
results based on the “intext” criteria we had specified above.
![](file:///C:/Users/Student/AppData/Local/Temp/msohtmlclip1/01/clip_image006.gif)
Google Search Operators
A search operator is used to
create complex search criteria. For
instance, you want to search for multiple items that are different in a single
search request. You may want to specify
certain items you do not want return if that keyword is located in the
results. This is where search operators
are used.
And (+): Specified by using
either the word AND or using the “+” symbol without quotes. Using this in the search term specified you
want to find results that use multiple criteria. For example:
dog + beagle + champion would return search results that include all
three items in the results.
Or (|): Specified by using
either the word OR or the “|”, also known as the pipe symbol. You use this search term to specify
conditional criteria. For example: 67 Nova | Malibu hotrods would return search
results containing the result of 67 Nova or 67 Malibu hotrods.
Google Hacking Search Terms
Note: Do not place a space between the Keyword
(e.g. cache) and the page url. cache:
If you include other words in
the query, Google will highlight those words within the cached document. For
instance, [cache:www.google.com web] will show the cached content with the word
“web” highlighted. This functionality is also accessible by clicking on the
“Cached” link on Google’s main results page. The query [cache:] will show the
version of the web page that Google has in its cache. For example the query cache:www.google.com
will show Google’s cache of the Google homepage.
link:
The query [link:] will list
webpages that have links to the specified webpage. For example the query link:www.google.com
will list webpages that have links pointing to the Google homepage.
related:
The query [related:] will list
web pages that are “similar” to a specified web page. For example the query related:www.google.com
will list web pages that are similar to the Google homepage.
Info:
The query [info:] will present
some information that Google has about that web page. For example the query info:www.google.com
will show information about the Google homepage.
site:
If you include [site:] in your
query, Google will restrict the results to those websites in the given domain.
For example in the query help site:www.google.com you will find
pages about help within www.google.com.
allintitle:
If you start a
query with [allintitle:], Google will restrict the results to those with all of
the query words in the title. For example in the query allintitle: google search you
will return only documents that have both “google” and “search” in the title. intitle:
If you include [intitle:] in
your query, Google will restrict the results to documents containing that word
in the title. For example in the query intitle:google search you will return
documents that mention the word “google” in their title, and mention the word
“search” anywhere in the document (title or no).
Notes:
1. there can be no space between the “intitle:”
and the following word.
2. Note:
Putting [intitle:] in front of every word in your query is equivalent to
putting [allintitle:] at the front of your query: [intitle:google
intitle:search] is the same as [allintitle: google search].
allinurl:
If you start a query with
[allinurl:], Google will restrict the results to those with all of the query
words in the url. For example in the query allinurl: google search you will return only documents that have both
“google” and “search” in the url.
Note
that [allinurl:] works on words, not url components. In particular, it ignores
punctuation. Thus, [allinurl: foo/bar] will restrict the results to page with
the words “foo” and “bar” in the url, but won’t require that they be separated
by a slash within that url, that they be adjacent, or that they be in that
particular word order. There is currently no way to enforce these constraints.
inurl:
If you include [inurl:] in
your query, Google will restrict the results to documents containing that word
in the url. For example in the query inurl:google search you will return
documents that mention the word “google” in their url, and mention the word
“search” anywhere in the document (url or no). Note there can be no space
between the “inurl:” and the following word.
Putting “inurl:” in front of
every word in your query is equivalent to putting “allinurl:” at the front of
your query: [inurl:google inurl:search] is the same as [allinurl: google
search].
Ready to try something more?
The following listing provides
a collection of the more popular search terms that will aid in your security
evaluation of your host targets.
Remember; always ensure you are performing these queries on your own
hosts or with the written permission of the hosts’ owner to avoid any potential
legal issues.
Common Google Hacking Terms and Expected Results
"#mysql dump" filetype:sql
"access denied for user" "using
password"
"Certificate Practice Statement" filetype:PDF |
DOC
"Generated by phpSystem"
"HTTP_FROM=googlebot" googlebot.com
"Server_Software="
"Host Vulnerability Summary Report"
"Index of" / "chat/logs"
"Installed Objects Scanner" inurl:default.asp
"Mecury Version" "Infastructure Group"
"Microsoft (R) Windows * (TM) Version * DrWtsn32 C
"Microsoft (R) Windows * (TM) Version * DrWtsn32
Copyright (C)" ext:log
"Most Submitted Forms and Scripts" "this
section"
“my webcamXP server!”
"Network Vulnerability Assessment Report"
"ORA-00921: unexpected end of SQL command"
"Request Details" "Control Tree"
"Server Variables"
"Running in Child mode"
"Thank you for your order" +receipt
"These statistics were produced by getstats"
"This is a Shareaza Node"
"This report was generated by WebLog"
"This summary was generated by wwwstat"
"allow_call_time_pass_reference"
"PATH_INFO"
"not for distribution" confidential
"phone * * *" "address *"
"e-mail" intitle:"curriculum vitae"
"phpMyAdmin" "running on"
inurl:"main.php"
"robots.txt" "Disallow:" filetype:txt
"sets mode: +p"
"sets mode: +s"
( filetype:mail | filetype:eml | filetype:mbox |
filetype:mbx ) intext:password|subject
(inurl:"robot.txt" | inurl:"robots.txt"
) intext:disallow filetype:txt
+":8080" +":3128" +":80"
filetype:txt
+"HSTSNR" -"netop.com"
-site:php.net -"The PHP Group" inurl:source
inurl:url ext:pHp
94FBR "ADOBE PHOTOSHOP"
AIM buddy lists
Financial spreadsheets: finance.xls
Financial spreadsheets: finances.xls
Ganglia Cluster Reports
ICQ chat logs, please...
Lotus Domino address books
Microsoft Money Data Files
MySQL tabledata dumps
OWA Public Folders (direct view)
Peoples MSN contact lists
Quicken data files
SQL data dumps
Squid cache server reports
Unreal IRCd Welcome to ntop!
allinurl:/examples/jsp/snp/snoop.jsp
allinurl:servlet/SnoopServlet buddylist.blt cgiirc.conf e-mail address
filetype:csv csv exported email addresses ext:asp inurl:pathto.asp ext:cgi
inurl:editcgi.cgi inurl:file= ext:conf NoCatAuth -cvs ext:conf
inurl:rsyncd.conf -cvs -man ext:dat bpk.dat ext:gho gho ext:ini intext:env.ini
ext:ldif ldif
ext:log "Software:
Microsoft Internet Information ext:log "Software: Microsoft Internet
Information Services *.*" ext:mdb inurl:*.mdb inurl:fpdb shop.mdb
ext:nsf nsf -gov ext:pqi pqi
-database ext:reg "username=*" putty ext:txt "Final encryption
key"
ext:txt inurl:dxdiag ext:vmdk
vmdk ext:vmx vmx
filetype:asp DBQ=" * Server.MapPath("*.mdb")
filetype:bkf bkf filetype:blt
"buddylist" filetype:blt blt +intext:screenname filetype:cfg
auto_inst.cfg filetype:cnf inurl:_vti_pvt access.cnf filetype:conf
inurl:firewall -intitle:cvs filetype:config web.config -CVS filetype:ctt
Contact filetype:ctt ctt messenger
filetype:eml eml
+intext:"Subject" +intext:"From" +intext:"To"
filetype:fp3 fp3 filetype:fp5 fp5 -site:gov -"cvs log"
filetype:fp7 fp7 filetype:inf
inurl:capolicy.inf filetype:lic lic intext:key filetype:log access.log -CVS
filetype:mbx mbx intext:Subject filetype:myd myd -CVS filetype:ns1 ns1
filetype:ora ora filetype:pst inurl:"outlook.pst" filetype:pst pst
-from -to -date filetype:rdp rdp filetype:wab wab filetype:xls -site:gov
inurl:contact filetype:xls inurl:"email.xls" haccess.ctl filetype:log
cron.log intext:"Session Start * * * *:*:* *" filetype:log intext:"Tobias
Oetiker" "traffic analysis"
intext:(password | passcode)
intext:(username | userid | user) filetype:csv intext:SQLiteManager
inurl:main.php
intitle:"Apache::Status" (inurl:server-status |
inurl:status.html | inurl:apache.html)
intitle:"AppServ Open Project"
-site:www.appservnetwork.com
intitle:"Big Sister"
+"OK Attention Trouble" intitle:"FTP root at"
intitle:"Index Of" cookies.txt size intitle:"index of"
mysql.conf OR mysql_config intitle:"index.of *" admin news.asp
configview.asp intitle:"wbem" compaq login intitle:"web server
status" SSH Telnet intitle:admin intitle:login intitle:index.of
"Apache" "server at" intitle:index.of dead.letter
intitle:index.of inbox dbx
intitle:intranet
inurl:intranet +intext:"phone" inurl:"newsletter/admin/"
inurl:"shopadmin.asp"
"Shop Administrators only" inurl:*db filetype:mdb inurl:admin
filetype:xls inurl:backup filetype:mdb inurl:changepassword.asp
inurl:forward filetype:forward
-cvs inurl:main.php Welcome to phpMyAdmin inurl:main.php phpMyAdmin
inurl:netscape.hst inurl:odbc.ini ext:ini -cvs inurl:preferences.ini
"[emule]" inurl:ssl.conf filetype:conf ipsec.conf
ipsec.secrets private key files
(.csr) private key files (.key)
Comments
Post a Comment