What is Google Dorking? - Understanding

Understanding Google Dorks

Google Dorking is all approximately pushing Google Search to its limits, with the aid of using the use of superior seek operators to inform Google precisely what you need. Many human beings view it as a Hacking Technique to locate unprotected touchy facts approximately a company, however I try and view it as extra of the Hacker Way of Thinking due to the fact I use Google Dorks for some distance extra than safety research. 

I first found out the energy of a Google Dork once I become seeking out the Cisco Anyconnect software program used to hook up with Cisco VPNs. However, Cisco didn’t permit for downloading the software program and googling “Cisco Anyconnect” brought about many web sites simply speaking approximately the software program. I checked out the superior seek operators of Google and observed I ought to seek the titles of internet pages. After seeing I ought to seek with the aid of using the HTTP Titles, I had an concept that if I searched for "Open Directory Listings", then my outcomes might be simply documents. I modified my seek question to intitle:index.of cisco anyconnect and unexpectedly I determined hundreds of outcomes. I ended up downloading the executable after which producing an MD5sum hash of the record then evaluating it with what become on Cisco’s webweb page. Once I determined a record that matched up, I knew it hadn’t been tampered with and become secure to run.

At the time I didn’t recognise this become known as Google Dorking, it wasn’t till I got here throughout the Google Hacking for Penetration Testers BlackHat presentation that I found out the overall energy of Google. 

Search Operators

Using Advanced Search Operators shall we me locate nearly whatever I need at the internet. Most human beings recognise approximately queries like webweb page:hackthebox.com ext:pdf to reveal all of the PDFs hosted on a domain. This can regularly be blended with exiftool to extract metadata from files revealing capacity usernames, dates, and software program used. However, many human beings don’t consider the use of it towards cloud garage like webweb page:drive.google.com hackthebox. Thankfully, this seek end result doesn’t provide you with too much. Google isn’t crawling drive.google.com itself however rather seeking out files published on the general public internet. My favored Google Dorks are:

 

Site and INURL

These operators look at the URL, I most customarily use the webweb page due to the fact many web sites have awful looking themselves. For example, in case you used Reddit’s integrated seek to look for ippsec after which use the Google Search: webweb page:reddit.com ippsec you may probably get absolutely specific outcomes. 

The INURL piece is precious in case you are seeking out a word to be withinside the URL however don’t care what internet site it's far used on. This is regularly used for measuring the effect an internet take advantage of may also have. For example, if a vulnerability got here out with a WordPress plugin, I might locate the filename of the plugin and use inurl:file_used_by_plugin.personal home page and spot what number of web sites will be suffering from this vulnerability. I might then construct a listing of web sites that provide malicious program bounties or participate in packages like Synack after which test if any of these webweb sites seem at the listing.

The Game-Changing Operator - Exclusion

Whenever acting a Google question, placing a hyphen will subtract that question from the outcomes. This is extraordinarily beneficial whilst seeking to do away with webweb sites or quantities of URL’s from the outcomes. Using -webweb page:internet site.com will ensure that the internet site does now no longer seem to your seek outcomes. This is likewise beneficial with the inurl: piece as it is able to do away with quantities of a internet site from the outcomes. 

Before and After

Google continues information of whilst pages had been first visible or remaining modified. Using the before/after tag is a super manner to slender the seek. There had been masses of instances whilst a current headline continues filling up my Google Search outcomes. Adding the tag before: is a super manner to cast off that. Also whilst an take advantage of comes out, I usually will use the after: tag to locate the today's evidence of standards. If the take advantage of got here out seven days in the past, I may also set the after tag to 2 days in the past and try and locate the latest evidence of standards which have a tendency to be the extra superior ones, while the exploits that pop out without delay after generally tend to simply be denial of services. 

Cache

Websites will regularly gift specific facts to serps for Search Engine Optimization (SEO) reasons. Using cache:url will let you view the web page a internet site again to Google. This is beneficial whilst the internet site is hiding facts at the back of a login. There is a misnomer round this feature, I’ve visible many human beings don't forget this “Passive Recon” that means that in case you regarded a internet site via the google cache then the internet site might haven't any concept you went there. This isn't always actual due to the fact regularly the Google cache won’t rewrite a few hyperlinks that mechanically load whilst viewing the cached end result, and your browser will nevertheless make internet requests to the goal webserver.

Google Advanced Search

If you navigate to google.com/advanced_search, you’ll be provided with a web page that facilitates craft a Google Dork and presentations the syntax to carry out the seek. The maximum thrilling putting is being capable of extrade the location to show outcomes. Google serves outcomes it thinks are of hobby to you and one of the foremost determining elements is in which it thinks you're located. For example, if I carry out the Google Search of “Google”, the primary end result is going to google.com. If I extrade the local settings to the United Kingdom it offers me google.co.uk. This may be beneficial to map out numerous nations an enterprise has infrastructure. However, now no longer all Google Dorks are for OSINT, that is similarly beneficial for looking information of overseas nations. As I am withinside the US, if I look for information associated with the United Kingdom Google will nevertheless supply precedence to americaA web sites which are protecting UK information. If I carry out the identical seek associated with the United Kingdom however extrade the local settings to the United Kingdom, it's going to now want nearby UK web sites over americaA-based.

Learn extra Google Dorks

There is lots extra to Google Dorking than what I stated here, with the aid of using some distance the first-class aid to visit is Exploit-DB’s Google Hacking Database.  I’m certain after you begin analyzing the Google Dorks themselves you’ll get numerous thoughts at dorks that might be beneficial to you. If now no longer, then look for numerous cloud vendors like Google Drive, OneDrive, Dropbox, etc, and spot how you may use Google to move slowly the ones files.

Use of automated tools

There are numerous computerized gear to be able to run a big variety of Google dorks for you and output to textual content documents letting you grep via the outcomes. This is useful due to the fact the primary time-ingesting component with a Google Dork is clicking via all of the Google pages. If you simply need a listing of all PDF’s on a webweb page, it's going to take some time writing every URL down 10 at a time (default outcomes in line with web page). Thankfully packages do this clicking for us!  These gear extrade quite regularly so it’s difficult to mention what's the first-class, perhaps use a webweb page:github.com after:(6 months in the past) Google Dork question and search for the maximum up to date gear.  However, one I like the use of is that this dork scanner.