See How You Can Use Google Search Engine For Hacking
Thanks to Google’s spiders which let Google index all the parts of any website if a ‘door’ is open. Google spiders can only be restricted using Robot.txt file. If webmaster fails to configure the Robot.txt file correctly then the situation can be worsened like a couple of years ago Google started indexing files like Word, PDF, Excel, Access, etc.
However, most of the time organizations didn’t protect their sensitive data and files. Thus, useful information started to appear in Google’s search results. You can get your hands on pieces of information using Google hacking: This data usually falls under these categories:
However, most of the time organizations didn’t protect their sensitive data and files. Thus, useful information started to appear in Google’s search results. You can get your hands on pieces of information using Google hacking: This data usually falls under these categories:
- User ID, computer account logins, passwords
- Private, or proprietary company data
- Personal and financial info
- Sensitive government information
- Flaws in websites and servers
Search Using File Types:
I already mentioned earlier that many organization saved their financial data in Microsoft Excel format. So, you need to search for the file types in Microsoft Excel format[filetype:xls site:za confidential]
Search Using File Types:
Filetype: you can search for different file types like Excel, Word or PowerpointSite: here you need to enter the name of a company or the URL of the enterprise and don’t forget to include stock words and phrases like do not distribute, proprietary, etc. at the end.
Looking for Login Information
If you need to search for login credentials, then let me tell you that foreign sites usually use these terms in English. So, search for a spreadsheet file might look like:[filetype:xls site:ru login]
Looking for Passwords:
Well, sometimes Google shows such directories in the search results that are not intended to be on the web. These misconfigured web servers provide some comprehensive set of information. You can use this format to exploit this error:
[intitle:”index of’ site:za password]
Numrange Searches:
NSA describes Numrange searches as one of the “scariest searches available through Google.” This numrange search uses two numbers which are separated by two dots and no spaces in between. For example:[site:www.thisismydadsbank.com 617..780]
You need to read Google hacking chapter in NSA’s eBook to get the detailed information regarding this searches.
Bypass the Registration process:
We often deal with some websites which ask us to register to view its contents. So, you can use Google Hacking trick to bypass the registration process. Try these queries or something similar in Google search:[site:www.companyname.com inurl:database]
[site:www.companyname.com inurl:directory]
[site:www.companyname.com inurl:index]
[site:www.companyname.com inurl:companies]