A vast and intensive field of study is hacking gadgets and devices to find vulnerabilities in them. And, it gets better when the massive search engine of all times, Google, helps you to find the information. These search engines are nothing else but basically web crawlers that can crawl down every single sub-domain to get you the exact piece of information. So here is everything that you need to know about how to perform Google Hacking, officially known a Google Dorking!
Where is Google Dorking used?
Dorking is a concept basically used when one wants to dig up some information from the plethora of data stored on the Internet. This information can vary from a picture, texts, to passwords, database, and PII (Personally Identifiable Information). These bits of texts are stored deep somewhere on the web and can be dug out with relevant search keys and a bit of checks. Dorking works as a passive reconnaissance methodology, that is, gathering as much information of the victim before planning an attack.
How does Google Dorking work?
Dorking is nothing but web crawlers of a particular search engine put to work for finding out confidential information. When you put the search parameters in a way that it reveals the information, such as plaintext passwords, that are stored in unencrypted format texts. With Dorking, you can also find out links for torrents without much hassle and use it.
What information can it provide you with?
You never know if you’re disclosing information that is too sensitive or can cause damage to your website if it falls into malicious hands. This can include usernames, passwords, vulnerability reports, MP3 music, movie links, PDF’s containing sensitive information, camera recording of some IP location, private keys, email credentials, hashing passwords, tokens and cookies that can be reused, log files, login pages that aren’t easily accessible, and much much more!
How to put a command for Google Dorking?
Follow these tips to provide right commands in the search box of Google Dorking.
- inurl: This command helps Google to understand the specified URL wherein you want to conduct your search.
- filetype: A specific kind of filetype with extensions such as pdf, jpeg, png, xlxs, doc, txt, mp3, mkv, etc., can be found out using this Dorking command.
- intext: This helps to find out a set of characters that is used anywhere in the website- be it a heading, sub-heading, meta-description, and tag.
- site: Site is used when we want to restrict our search to domains and sub-domains of a particular website only, such as Microsoft.
- password: You can use this command with multiple filetype combinations as we never know the format in which sensitive information can be stored.
- double inverted commas (“”): This helps us to address a specific word and crawls around it very well if supported with filetype, site, and intext commands.
Certain examples can be:
- password filetype: pdf
- insite: abc.xyz intext:passwords filetype: xlxs
- inurl: xyz.com filetype: txt intext: confidential
How to prevent Google Dorking?
Here are a few ways with which you can prevent Google Dorking:
- Perform a security check yourself using common Dorking commands before anyone with evil intentions does so!
- Always restrict access to sensitive information by specifying roles such as who can access up to what privileges!
- Always store your passwords and usernames in an encrypted format on the web that can be decrypted with the private keys of a specific set of people who own the key.
- Use robots.txt file in your website to prevent the Dorking.
Word of caution!
Although we have suggested various forms of direct information regarding Google Dorking, we highly suggest you to not use it. If you do, then you might land up in legal troubles. Hackers that make use of this concept are generally White Hat Hackers and they take part in reconnaissance to safeguard the web applications. Thinking that a VPN might save you is merely foolish and it is better if you use these tools for the sake of goodwill of everyone. Moreover, every activity is being tracked by your ISP (Internet Service Provider) and thus, you must take care that your actions won’t become a threat to mankind!
You may also like:
Author’s Bio: This article has been written by Rishika Desai, B.Tech Computer Engineering graduate with 9.57 CGPA from Vishwakarma Institute of Information Technology (VIIT), Pune. Currently works as Threat Intelligence Researcher in CloudSEK. She is a good dancer, poet and a writer. Animal love engulfs her heart and content writing comprises her present. You can follow Rishika on Twitter at @ich_rish99.