L0phtcrack 5 with crack & keygen

L0phtCrack 5 is the award-winning password audit and recovery tool for Windows and Unix passwords.
For Download : Click Here

Cain & Abel password cracking Tool

Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort. It covers some security aspects/weakness present in protocol's standards, authentication methods and caching mechanisms; its main purpose is the simplified recovery of passwords and credentials from various sources, however it also ships some "non standard" utilities for Microsoft Windows users.
For Download : Click Here

CEH v6 + v5 Courseware

Here is CEH v6 + v5 Courseware.

For Download:
Part 1

Part 2

Part 3

The Password for the .RAR files is Crypto
Enjoy...

Skype Software

For Download: Click Here

SAM's Teach yourself C++ in 24 hours

Book for C++ language.

For Download : Click Here

Sniffers and process of Sniffing

For Educational purpose only. I shall not be responsible for any damage.

Let us discuss about Sniffers and process of Sniffing. Before starting this topic I assume that you have basic understanding of concepts of Networking.

A snifer is basically a program or software or hardware that can capture packets travelling through the network. The process of capturing data by the sniffer is known as snffing. Remember Sniffing is done in LAN not in WAN.

Sniffing is of two types:

Active sniffing

Passive sniffing

Passive sniffing is carried out in common collision domain. Collision Domain is a network in which whenever packet is sent by any host, all hosts response to that packet in that network & if during same time some other machine transmitts a packet then a collision will occur in network. For eg: HUB is a layer 1 device which operates at physical layer of OSI model. It creates a single collision domain. The internal structure of HUB is based on Bus topology. It operates at layer 1 of OSI model. So when any packet is sent by one machine connected to HUB then this packet will be broadcasted to all other machines attached to that same HUB. This type of network is called Colision Domain. So in order to perform this type of sniffing we only need to install sniffer on one of the machine in collision domain & we'll get all packets that transmit through the network. I know there was no much fun in this.

How to prevent your network from passive sniffing ?

In order to prevent the passive sniffing, we need to prevent the broadcasting of the packets in our packet. Now how to prevent braodcasting ?

As HUB is broadcasting device so we need to use some intelligent device instead of HUB. The solution is to replace HUB with Switch. Beware this will increase cost of your n/w too. Switch device don't broadcast packets everytime. So if sniffer is installed on one machine in the network then it can't intercept all the packets transmitting through the network because there would not be much broadcasts in Switch network..!! You can understand this by knowing how a switch works.

How a switch works ?

Switch is layer 2 device & works using MAC addresses. There are also switches that work at layer 3 of OSI model. The internal structure of switch is based on start topology. Switch basically has a Content Addressable Memory(CAM). This memory contains a table in which there is information about the MAC address of machines attached to its ports ie. MAC to port mapping. In starting the table in CAM is empty & it is filled slowly when the communication starts within the network.

The switch functions in three steps:

1. Broadcasting (Packets are sent to all machines in n/w)

2. Multicasting (Packets are sent to specific group of machines in n/w)

3. Unicasting (Packets are sent to single specific machine in n/w)

Consider a new switch is installed in network,So at first time when a machine 'A' attached to switch send a packet to other machine 'B' using its IP address, now as switch doesn't understand IP address & it doesn't knows machine 'B' MAC address so it will broadcast this packet to all ports, to all the machines attached to the switch. Now all the machines other than 'B' will discard the packet and only machine 'B' will reply. So, now the switch will note the MAC address of the machine 'A' and 'B' & the ports on which they are connected in its table in CAM. Now switch knows on which ports the machine 'A' and 'B' are attached. Now if machine 'A' again sends a packet to 'B' then, now switch will not broadcast the packet but it will directly be sent to 'B' machine. This is called Unicasting. Now if machine 'A' sends packet to any machine other than 'B'

then switch will broadcast packet to all other machines but not to 'B' machine. This is called multicasting. Multicasting is special type of broadcasting in which broadcasting is done to specific group only.

Switch notes the MAC address of the machines whenever a communication takes place untill all the MAC addresses are collected in table in CAM. When all MAC addresses are collected in CAM now switch will perform unicasting.

Now let us discuss Active sniffing.

Active sniffing is carried out in network that have different collision domains. eg: A switch network have different collision domains.Each port of switch is one collision domain. There are following ways to carry out Active sniffing.

1. Arp Spoofing

2. MAC flooding

3. MAC duplicating

Arp Spoofing:

ARP is Address Resolution Protocol. It is used to resolve the IP address of machine to its MAC address. which means it is used to get MAC of machine who's IP is known. Now ARP is stateless, which mean you can make an ARP reply even if no ARP request is made..!! ;-) Now when an attacker's machine wants to sniff it will send fake malicious ARP packets to other victim machine so that, the victim machine sends packets to attacker machine. In this attack basically the gateway of network is spoofed.This is how it works. Let an attacker machine 'A'with IP address 10.0.0.1 wants to get packets of victim machine with IP 10.0.0.2, let the IP address of gateway is 10.0.0.3, Now the attacker machine 10.0.0.1 will send malicious ARP reply packet to gateway 10.0.0.3, associating its MAC address with 10.0.0.2(victim IP) now gateway will think that attacker's machine is victim's machine. At same time attacker send malicious ARP packet to victim machine 10.0.0.2, associating it MAC address with 10.0.0.3(gatewy IP), now the Victim's machine will think that attacker's machine is gateway. Now the gateway will send all the packets belonging to victim machine 10.0.0.2 to attacker's machine and victim's machine will send all packets belonging to gateway 10.0.0.3 to attacker's machine. Thus attackers now sits between Gateway & Victim machine. It is like MAN in Middle Attack. Now the attacker uses IP forwarding technique to send all packets from victim to gateway through it & vice-versa. Now as all packets are being sent and received between gateway and victim machine so, victim remains unaware about the interception of packets by the attacker..!!

MAC Flooding:

This type of attack targets the limited capability of a switch to hold MAC address to physical port mappings. In this we try to make switch to operate like HUB(to broadcast all packets). As I told you before that a switch has table in memory(CAM). This memory has a limited size. It can hold only some specific number of MAC entries. Now in this type of attack the attacker will send lot of spoofed ARP reply packets in the network. Now when there ar so many entries in a switch, thid causes a switch to operate in failopen mode. In this mode the switch will broadcast all the packets to all ports, like HUB. Now attacker can sniff every packet on network.

MAC duplicating:

In this attack the attacker first sniffs the network for MAC addresses of other machines on n/w. Then it try to use one of that MAC addresses. By this intruder can get all packets that are destined for that MAC address. This attack works as follow:

Suppose a network is already functioning. Let victim's IP be 10.0.0.1 & MAC be ab:1c:4b:2b:56:0b , and victim is already communicating in network. Now attacker with IP 10.0.0.2 joins the network. Now attacker sniffs the MAC of victim, then the attacker will start making ARP reply in network by associating its IP 10.0.0.2 with MAC ab:1c:4b:2b:56:0b ,

now every machine on network will consider attacker's machine as victim's machine, and all packets destined to victim will now be recieved to attacker.

This attack is mainly used in Wireless networks.

How to prevent Active sniffing ?

It can be prevented by using Port Security feature of a switch.In this feature we manually allocate or assign MAC address to the ports of the switch. Now the switch will only receive packets from the MAC address that are defined by us. For eg: If I define fast ethernet port 1 to MAC address a0:bc:1d:67:0a:2a now the fast ethernet port 1 of switch will accept packets from this a0:bc:1d:67:0a:2a MAC only.

In order to implement Sniffing, we first need to get IP, MAC of machines working on network. After getting this information then u can implement sniffing attacks.

The arp attack can be done by using arp command. type arp/? in cmd in windows OS to know more. There are many sniffer software available to perform sniffing. As follow:

In order to sniff IP & MAC of machines u can use following s/w:

Wireshark, Look@LAN, The Dude sniffer, Network view. etc

For ARP attack:

ARP spoof, ArpSpyX, Ethercap, Cain and Abel etc.

For MAC flooding:

Macof, Etherflood.

Once again Hacking is a crime. Beware when you use these tools...!!!

Crypto will not be responsible for any damage..!!!

How to block websites without using any software ?

For education purpose only. I shall never be responsible for any damage.

Beware don't mess much with the system files.

So here is the way how to block any website on your machine without using any software in window XP.

We do this by editing the Hosts file in our machine. Hosts file is file that contains IP address to hosts name mappings. When ever we open any website the host name to IP address mapping takes place. Like if you type www.google.com and hit enter then, first the machine will resolve the google.com to its IP address and after that it makes connection to google using its IP address. This is called name resolution and it is done by DNS(Domain Name Server). But in case of window OS the Hosts file is prefered to do mapping, and if no mapping is availabel in Hosts file then mapping is done by DNS. This means the OS will first look for mapping in Hosts file rather than directly making a DNS query.

So now we edit Hosts file so that mapping takes place according to ourself, what we define.

First of all you need to edit the Hosts file in your machine. First make backup of Hosts file. The Hosts file is situated at :

C:\WINDOWS\system32\drivers\etc

if C:\ is your installation directory.

You will see there will be a file named as Hosts.

Open that file in wordpad.

now type following at end of file, create new line at last:

127.0.0.1 Website name u want to block

Save the file and exit.

for example if I want to block orkut.com then I type following :

127.0.0.1 orkut.com

Don't forget to enter space between 127.0.0.1 and orkut.com in above line.

How it works ??

127.0.0.1 is a loopback address. This address is used to check status of TCP/IP in a machine. This is the address that is used to connect to your own machine. For eg:

Open CMD and type the following & hit enter:

ping 127.0.0.1

you will get 100% success, because you are pinging your own machine. If you don't get success then it means there is problem with your TCP/IP settings or your OS have some problems.

Now in above example we are telling to Hosts file that, the IP address of orkut.com is 127.0.0.1 ,

so now when you type orkut.com in browser, your browser will ask Hosts file about IP address and as we have mapped orkut.com's IP to 127.0.0.1 so browser will redirect you to 127.0.0.1.

Thus the website will no open. ;-)

This trick can be used in other way too. Suppose if u try to open yahoo.com , but google.com opens..!!! if u want this to happen then u can try this.

put this line in hosts file as explained above:

74.125.43.104 www.yahoo.com

when u try to access yahoo.com you will be redirected to google.com ;-)

This works as same as I have described above.

How most keyloggers work ?

Most of the keyloggers capture the data before it is written to any application like notepad, browser etc. They use different techniques like hooks, polling etc.

In Polling technique the keylogger keep inquiring the OS that, Has any key been pressed ? if any key is pressed it is then notified to the keylogger. It is passive method.

In Hooks technique the keylogger is informed in advance when data is to be written to application. Which means before your data is written to notepad or email or any other application the keylogger gets the data & it is logged.

Keylogger captures data by features like:

1. Screen shots:

Some keylogger log data by taking screen shots of the pc. They take photos of your screen – usually just around your mouse – either at periodic intervals, or every time you do a mouse click. They programattically take a screenshot of the control (button, text box etc) that is under the mouse using Windows API commands.

2. Mouse Position logging

Each time you click, the coordinates of your mouse are captured by the keylogger. As everytime the onscreen keyboard opens at same position so it is easy to guess the key pressed by knowing the coordinates at which the mouse was clicked.

3. Field scraping :

Field scraping is a term we use to discribe a technique used by quite a few commercial keyloggers to grab your passwords directly from the password field.

How does it work? Using Windows API commands, programs can ask Windows for a list of controls in a program (like buttons, text boxes and picture controls). From this, they know about the text boxes in the program. They then ask Windows whether the text boxes have a password mask (ie. if password is written in ***** form). If yes they can then even get the password in plaintext form.

4. Clipboard logging :

It is a common feature of keyloggers. Whatever you copy to the clipboard is stored, it can be captured by the keylogger. What ever data you cut , copy , paste it is recorded in clipboard and it can be captured by keylogger too.

I recommend you to create your own keylogger for better results. Use language like Visual Basic, C++ , Assembly etc.

Here is list of some keylogger available on internet:

1. Email Keylogger Click Here

2. Revealer Keylogger Click Here

3. Handy Keylogger Click Here

4. Ardamax Keylogger Click Here

5. Powered keylogger Click Here

6. ELITE keylogger Click Here

7. Quick keylogger Click Here

8. Spy keylogger Click Here

9. Perfect keylogger Click Here

10. Invisible keylogger Click Here

11. Actual spy Click Here

12. Spytector ftp keylogger Click Here

13. IKS software keylogger Click Here

14. Ghost keylogger Click Here

Google Hacking

Google hacking is a technique in which we make complex queries in Google in order to extract the information that we can use to hack website and many more stuff. Google hacking technique don't hack a website, but it provides information that assisst in hacking. This information is not available by making simple query in google.

Many people have misconsideration that in this technique we hack google.com, this is incorrect we don't hack google.com, no one does (after all it is a great search engine ;-) )

Before trying ur hand on google hacking I would like u to take care of some tips.

1. Don't use Google chrome for google hacking.

2. Open google.com now if u see ur email id on top right corner of ur browser then sign out first before performing google hacking.

3. Every website is not vulnerable to google hacking.

4. "|" used in google hacking means OR.

So now how to make complex queries. Complex queries are made by using google operators and ur innovation. There are several operators each have different function and give different result when used in google search query. But it depends upon ur thinking power that how u make a query to find specific results. You can also use more than one operator at a time.Lets start with all operators 1 by 1.

1. Site operator:

This operator is basically used for searching basic information about a target website.

type in google the following:

site:website address

Following is example to how to use it:

type site:yahoo.com in google and see the results. You can now see all the other domains of yahoo.com. you can use any site instead of yahoo.com

Howover u may be thinking this information is very common. But hackers uasually use this information to learn all the links of a site.

A long time before I tried site:hotmail.com in google query and i got so only 2 links in result. And u may not believe me that when I examined those urls they contained username and password. But when i tried to login those account it just failed.

2. intitle:index.of

This operator provides universal directory listing. It most works on apache based servers.

for this type follwoing in google:

intitle:index.of

you can also use it for specific websites like as following:

site:yahoo.com intitle:index.of

site:naukri.com intitle:index.of

3. Error|Warning

This operator can reveal gr8 information about target.This operator provide the information related to error that have occured on a website. This can reveal the applications used, OS etc of web server. Following must be entered in google:

intitle:error|warning

or try this

intitle:index.of intitle:error

for example enter the following in google and hit enter to see the results:

intitle:error

4. login|logon

This operator can reveal information regarding the login process. This operator can aslo reveal information containing email addresses, phone numbers or URLs of human assistants who can help who has trouble due to lost password. This assisstant help desk persons are perfect target of Social Engineering. Type the following in google:

login|logon

for example enter the following in google and search.

site:kreeda.com login|logon

5. Username|Userid|employe.id|your username is

This operator can be used to obtain username from target. You sholud use "your username is" string with intext operator. like intext:"your uesrname is"

Enter the follwoing code in Google:

username|userid|employee.id|your username is

if u get username then u can try to get the password of that site.

for example enter the following code to see in results u can get username of some persons:

site:myspace.com username|userid|employee.id|your username is

or

site:myspace.com intext:username|userid|employee.id|your username is

6. password|passcode|passkey|key|pwd|your password is

This operator can be used to reveal password from a website. It could also reveal the login authentication procedure. This query must used with site operator for specific results.

Enter the follwoing in google:

password|passcode|key|pwd|your password is

7. admin|administrator

This operator can get information about admin of website. However this operator give many irrevelant results too. Many times when error occurs we are provided with message to contact o administrator. So this query can also lead u too such results.

type followng in google:

admin|administrator

8. admin logon

This operator can reveal the admin login pages that is the page where admin logins a website.

However this operator needs to be used along with inurl operator for better results. like

inurl:admin logon

If u get password of admin then u can own a site.

9. -ext or filetype:

This operator is similar to operator filetype: Both operators can be used to get file os particular formats -ext is synonym of filetype: operator. -ext is -ve operator that means it wont give any result if used alone. So use it with site: operator like: site:website name -ext:pdf

In case of filetype: operator. For eg. if u want to get file of pdf format then type follwoing in google:

filetype:pdf

It will give u all pdf files. but if u want a specific pdf file like crypto.pdf then try following

code in google:

intext:crypto filetype:pdf

This operator is very important if u are looking for some specfic file on internet. eg. Suppose u want a file named crypto.mp3 from a specific website www.songslover.com then in order to find such file type u shall type follwoing code:

site:songslover.com intext:crypto filetype:mp3

This operator can be used to search books, software, songs, videos, games etc.

try this :

filetype:pdf intext:Hacking

The filetype: operator can aslo be used to get passwords. For example we can search specific registry files that can contain password. The password is usually in encrypted form or in hexadecimal.

type following in google:

filetype:reg intext:"internet account manager"

similarily u can extract passwords from a .mdb, .pwd and other database extension files.

try this:

filetype:pwd intext:"password is"|"passcode"

try this:

filetype:pwd inurl:_vti_pvt inurl:authors|administrators

10. inurl:temp|inurl:tmp|inurl:backup|inurl:bak

This operator basically searches for backup files on internet. This operator must be used with site: operator in order to find temperory or backup files of the target website. The temperory files and backup files can contain sensitive information.

The above query can also be written as inurl:temp|temperory|bak|backup

but remember when we use lots of OR's that is "|" in our query then we don't get much good results.

11. inurl:

This operator is also very useful one. Suppose u want to get the names of websites that contain a specific word. Then use this operator to assisst u. just type follwoing in google:

inurl:keyword

here keyword is the word that u want in url or web address.for eg. if I enter following in google:

inurl:crypto36

you can see it gives URLs that belong to my blogspot...!!!

Remember:

1. Avoid using lot of "|" in query.

2. The google hacking depends on ur thinking power & innovation. you can create ur own queries

by using different operators.

3. Every website is not vulnerable to google hacking. Besause of awareness of google hacking

many websites have started avoiding their specific pages to be displayed in google's result.

For example as i told u before the case of site:hotmail.com , now u wont find that result that i saw

year ago.

Here are some more queries that you can try. Type in google the following queries and see the results :

• admin account info” filetype:log
• !Host=*.* intext:enc_UserPassword=* ext:pcf
• “# -FrontPage-” ext:pwd inurl:(service | authors | administrators | users) “# -FrontPage-” inurl:service.pwd
• “AutoCreate=TRUE password=*”
• “http://*:*@www” domainname
• “index of/” “ws_ftp.ini” “parent directory”
• “liveice configuration file” ext:cfg -site:sourceforge.net
• “parent directory” +proftpdpasswd
• Duclassified” -site:duware.com “DUware All Rights reserved”
• duclassmate” -site:duware.com
• Dudirectory” -site:duware.com
• dudownload” -site:duware.com
• Elite Forum Version *.*”
• Link Department”
• “sets mode: +k”
• “your password is” filetype:log
• DUpaypal” -site:duware.com
• allinurl: admin mdb
• auth_user_file.txt
• config.php
• eggdrop filetype:user user
• enable password | secret “current configuration” -intext:the
• etc (index.of)
• ext:asa | ext:bak intext:uid intext:pwd -”uid..pwd” database | server | dsn
• ext:inc “pwd=” “UID=”
• ext:ini eudora.ini
• ext:ini Version=4.0.0.4 password
• ext:passwd -intext:the -sample -example
• ext:txt inurl:unattend.txt
• ext:yml database inurl:config
• filetype:bak createobject sa
• filetype:bak inurl:”htaccess|passwd|shadow|htusers”
• filetype:cfg mrtg “target
• filetype:cfm “cfapplication name” password
• filetype:conf oekakibbs
• filetype:conf slapd.conf
• filetype:config config intext:appSettings “User ID”
• filetype:dat “password.dat”
• filetype:dat inurl:Sites.dat
• filetype:dat wand.dat
• filetype:inc dbconn
• filetype:inc intext:mysql_connect
• filetype:inc mysql_connect OR mysql_pconnect
• filetype:inf sysprep
• filetype:ini inurl:”serv-u.ini”
• filetype:ini inurl:flashFXP.ini
• filetype:ini ServUDaemon
• filetype:ini wcx_ftp
• filetype:ini ws_ftp pwd
• filetype:ldb admin
• filetype:log “See `ipsec –copyright”
• filetype:log inurl:”password.log”
• filetype:mdb inurl:users.mdb
• filetype:mdb wwforum
• filetype:netrc password
• filetype:pass pass intext:userid
• filetype:pem intext:private
• filetype:properties inurl:db intext:password
• filetype:pwd service
• filetype:pwl pwl
• filetype:reg reg +intext:”defaultusername” +intext:”defaultpassword”
• filetype:reg reg +intext:â? WINVNC3â?
• filetype:reg reg HKEY_CURRENT_USER SSHHOSTKEYS
• filetype:sql “insert into” (pass|passwd|password)
• filetype:sql (“values * MD5? | “values * password” | “values * encrypt”)
• filetype:sql +”IDENTIFIED BY” -cvs
• filetype:sql password
• filetype:url +inurl:”ftp://” +inurl:”;@”
• filetype:xls username password email
• htpasswd
• htpasswd / htgroup
• htpasswd / htpasswd.bak
• intext:”enable password 7?
• intext:”enable secret 5 $”
• intext:”EZGuestbook”
• intext:”Web Wiz Journal”
• intitle:”index of” intext:connect.inc
• intitle:”index of” intext:globals.inc
• intitle:”Index of” passwords modified
• intitle:”Index of” sc_serv.conf sc_serv content
• intitle:”phpinfo()” +”mysql.default_password” +”Zend s?ri?ting Language Engine”
• intitle:dupics inurl:(add.asp | default.asp | view.asp | voting.asp) -site:duware.com
• intitle:index.of administrators.pwd
• intitle:Index.of etc shadow
• intitle:index.of intext:”secring.skr”|”secring.pgp”|”secring.bak”
• intitle:rapidshare intext:login
• inurl:”calendars?ri?t/users.txt”
• inurl:”editor/list.asp” | inurl:”database_editor.asp” | inurl:”login.asa” “are set”
• inurl:”GRC.DAT” intext:”password”
• inurl:”Sites.dat”+”PASS=”
• inurl:”slapd.conf” intext:”credentials” -manpage -”Manual Page” -man: -sample
• inurl:”slapd.conf” intext:”rootpw” -manpage -”Manual Page” -man: -sample
• inurl:”wvdial.conf” intext:”password”
• inurl:/db/main.mdb
• inurl:/wwwboard
• inurl:/yabb/Members/Admin.dat
• inurl:ccbill filetype:log
• inurl:cgi-bin inurl:calendar.cfg
• inurl:chap-secrets -cvs
• inurl:config.php dbuname dbpass
• inurl:filezilla.xml -cvs
• inurl:lilo.conf filetype:conf password -tatercounter2000 -bootpwd -man
• inurl:nuke filetype:sql
• inurl:ospfd.conf intext:password -sample -test -tutorial -download
• inurl:pap-secrets -cvs
• inurl:pass.dat
• inurl:perform filetype:ini
• inurl:perform.ini filetype:ini
• inurl:secring ext:skr | ext:pgp | ext:bak
• inurl:server.cfg rcon password
• inurl:ventrilo_srv.ini adminpassword
• inurl:vtund.conf intext:pass -cvs
• inurl:zebra.conf intext:password -sample -test -tutorial -download
• LeapFTP intitle:”index.of./” sites.ini modified
• master.passwd
• mysql history files
• NickServ registration passwords
• passlist
• passlist.txt (a better way)
• passwd
• passwd / etc (reliable)
• people.lst
• psyBNC config files
• pwd.db
• server-dbs “intitle:index of”
• signin filetype:url
• spwd.db / passwd
• trillian.ini
• wwwboard WebAdmin inurl:passwd.txt wwwboard|webadmin
• [WFClient] Password= filetype:ica
• intitle:”remote assessment” OpenAanval Console
• intitle:opengroupware.org “resistance is obsolete” “Report Bugs” “Username” “password”
• “bp blog admin” intitle:login | intitle:admin -site:johnny.ihackstuff.com
• “Emergisoft web applications are a part of our”
• “Establishing a secure Integrated Lights Out session with” OR intitle:”Data Frame – Browser not HTTP 1.1 compatible” OR intitle:”HP Integrated Lights-
• “HostingAccelerator” intitle:”login” +”Username” -”news” -demo
• “iCONECT 4.1 :: Login”
• “IMail Server Web Messaging” intitle:login
• “inspanel” intitle:”login” -”cannot” “Login ID” -site:inspediumsoft.com
• “intitle:3300 Integrated Communications Platform” inurl:main.htm
• “Login – Sun Cobalt RaQ”
• “login prompt” inurl:GM.cgi
• “Login to Usermin” inurl:20000
• “Microsoft CRM : Unsupported Browser Version”
• “OPENSRS Domain Management” inurl:manage.cgi
• “pcANYWHERE EXPRESS Java Client”
• “Please authenticate yourself to get access to the management interface”
• “please log in”
• “Please login with admin pass” -”leak” -sourceforge
• CuteNews” “2003..2005 CutePHP”
• DWMail” password intitle:dwmail
• Merak Mail Server Software” -.gov -.mil -.edu -site:merakmailserver.com
• Midmart Messageboard” “Administrator Login”
• Monster Top List” MTL numrange:200-
• UebiMiau” -site:sourceforge.net
• “site info for” “Enter Admin Password”
• “SquirrelMail version” “By the SquirrelMail development Team”
• “SysCP – login”
• “This is a restricted Access Server” “Javas?ri?t Not Enabled!”|”Messenger Express” -edu -ac
• “This section is for Administrators only. If you are an administrator then please”
• “ttawlogin.cgi/?action=”
• “VHCS Pro ver” -demo
• “VNC Desktop” inurl:5800
• “Web-Based Management” “Please input password to login” -inurl:johnny.ihackstuff.com
• “WebExplorer Server – Login” “Welcome to WebExplorer Server”
• “WebSTAR Mail – Please Log In”
• “You have requested access to a restricted area of our website. Please authenticate yourself to continue.”
• “You have requested to access the management functions” -.edu
• (intitle:”Please login – Forums
• UBB.threads”)|(inurl:login.php “ubb”)
• (intitle:”Please login – Forums
• WWWThreads”)|(inurl:”wwwthreads/login.php”)|(inurl:”wwwthreads/login.pl?Cat=”)
• (intitle:”rymo Login”)|(intext:”Welcome to rymo”) -family
• (intitle:”WmSC e-Cart Administration”)|(intitle:”WebMyStyle e-Cart Administration”)
• (inurl:”ars/cgi-bin/arweb?O=0? | inurl:arweb.jsp) -site:remedy.com -site:mil
• 4images Administration Control Panel
• allintitle:”Welcome to the Cyclades”
• allinurl:”exchange/logon.asp”
• allinurl:wps/portal/ login
• ASP.login_aspx “ASP.NET_SessionId”
• CGI:IRC Login
• ext:cgi intitle:”control panel” “enter your owner password to continue!”
• ez Publish administration
• filetype:php inurl:”webeditor.php”
• filetype:pl “Download: SuSE Linux Openexchange Server CA”
• filetype:r2w r2w
• intext:”"BiTBOARD v2.0? BiTSHiFTERS Bulletin Board”
• intext:”Fill out the form below completely to change your password and user name. If new username is left blank, your old one will be assumed.” -edu
• intext:”Mail admins login here to administrate your domain.”
• intext:”Master Account” “Domain Name” “Password” inurl:/cgi-bin/qmailadmin
• intext:”Master Account” “Domain Name” “Password” inurl:/cgi-bin/qmailadmin
• intext:”Storage Management Server for” intitle:”Server Administration”
• intext:”Welcome to” inurl:”cp” intitle:”H-SPHERE” inurl:”begin.html” -Fee
• intext:”vbulletin” inurl:admincp
• intitle:”*- HP WBEM Login” | “You are being prompted to provide login account information for *” | “Please provide the information requested and press
• intitle:”Admin Login” “admin login” “blogware”
• intitle:”Admin login” “Web Site Administration” “Copyright”
• intitle:”AlternC Desktop”
• intitle:”Athens Authentication Point”
• intitle:”b2evo > Login form” “Login form. You must log in! You will have to accept cookies in order to log in” -demo -site:b2evolution.net
• intitle:”Cisco CallManager User Options Log On” “Please enter your User ID and Password in the spaces provided below and click the Log On button to co
• intitle:”ColdFusion Administrator Login”
• intitle:”communigate pro * *” intitle:”entrance”
• intitle:”Content Management System” “user name”|”password”|”admin” “Microsoft IE 5.5? -mambo
• intitle:”Content Management System” “user name”|”password”|”admin” “Microsoft IE 5.5? -mambo
• intitle:”Dell Remote Access Controller”
• intitle:”Docutek ERes – Admin Login” -edu
• intitle:”Employee Intranet Login”
• intitle:”eMule *” intitle:”- Web Control Panel” intext:”Web Control Panel” “Enter your password here.”
• intitle:”ePowerSwitch Login”
• intitle:”eXist Database Administration” -demo
• intitle:”EXTRANET * – Identification”
• intitle:”EXTRANET login” -.edu -.mil -.gov
• intitle:”EZPartner” -netpond
• intitle:”Flash Operator Panel” -ext:php -wiki -cms -inurl:asternic -inurl:sip -intitle:ANNOUNCE -inurl:lists
• intitle:”i-secure v1.1? -edu
• intitle:”Icecast Administration Admin Page”
• intitle:”iDevAffiliate – admin” -demo
• intitle:”ISPMan : Unauthorized Access prohibited”
• intitle:”ITS System Information” “Please log on to the SAP System”
• intitle:”Kurant Corporation StoreSense” filetype:bok
• intitle:”ListMail Login” admin -demo
• intitle:”Login -
• Easy File Sharing Web Server”
• intitle:”Login Forum
• AnyBoard” intitle:”If you are a new user:” intext:”Forum
• AnyBoard” inurl:gochat -edu
• intitle:”Login to @Mail” (ext:pl | inurl:”index”) -dwaffleman
• intitle:”Login to Cacti”
• intitle:”Login to the forums – @www.aimoo.com” inurl:login.cfm?id=
• intitle:”MailMan Login”
• intitle:”Member Login” “NOTE: Your browser must have cookies enabled in order to log into the site.” ext:php OR ext:cgi
• intitle:”Merak Mail Server Web Administration” -ihackstuff.com
• intitle:”microsoft certificate services” inurl:certsrv
• intitle:”MikroTik RouterOS Managing Webpage”
• intitle:”MX Control Console” “If you can’t remember”
• intitle:”Novell Web Services” “GroupWise” -inurl:”doc/11924? -.mil -.edu -.gov -filetype:pdf
• intitle:”Novell Web Services” intext:”Select a service and a language.”
• intitle:”oMail-admin Administration – Login” -inurl:omnis.ch
• intitle:”OnLine Recruitment Program – Login”
• intitle:”Philex 0.2*” -s?ri?t -site:freelists.org
• intitle:”PHP Advanced Transfer” inurl:”login.php”
• intitle:”php icalendar administration” -site:sourceforge.net
• intitle:”php icalendar administration” -site:sourceforge.net
• intitle:”phpPgAdmin – Login” Language
• intitle:”PHProjekt – login” login password
• intitle:”please login” “your password is *”
• intitle:”Remote Desktop Web Connection” inurl:tsweb
• intitle:”SFXAdmin – sfx_global” | intitle:”SFXAdmin – sfx_local” | intitle:”SFXAdmin – sfx_test”
• intitle:”SHOUTcast Administrator” inurl:admin.cgi
• intitle:”site administration: please log in” “site designed by emarketsouth”
• intitle:”Supero Doctor III” -inurl:supermicro
• intitle:”SuSE Linux Openexchange Server” “Please activate Javas?ri?t!”
• intitle:”teamspeak server-administration
• intitle:”Tomcat Server Administration”
• intitle:”TOPdesk ApplicationServer”
• intitle:”TUTOS Login”
• intitle:”TWIG Login”
• intitle:”vhost” intext:”vHost . 2000-2004?
• intitle:”Virtual Server Administration System”
• intitle:”VisNetic WebMail” inurl:”/mail/”
• intitle:”VitalQIP IP Management System”
• intitle:”VMware Management Interface:” inurl:”vmware/en/”
• intitle:”VNC viewer for Java”
• intitle:”web-cyradm”|”by Luc de Louw” “This is only for authorized users” -tar.gz -site:web-cyradm.org
• intitle:”WebLogic Server” intitle:”Console Login” inurl:console
• intitle:”Welcome Site/User Administrator” “Please select the language” -demos
• intitle:”Welcome to Mailtraq WebMail”
• intitle:”welcome to netware *” -site:novell.com
• intitle:”WorldClient” intext:”? (2003|2004) Alt-N Technologies.”
• intitle:”xams 0.0.0..15 – Login”
• intitle:”XcAuctionLite” | “DRIVEN BY XCENT” Lite inurl:admin
• intitle:”XMail Web Administration Interface” intext:Login intext:password
• intitle:”Zope Help System” inurl:HelpSys
• intitle:”ZyXEL Prestige Router” “Enter password”
• intitle:”inc. vpn 3000 concentrator”
• intitle:(“TrackerCam Live Video”)|(“TrackerCam Application Login”)|(“Trackercam Remote”) -trackercam.com
• intitle:asterisk.management.portal web-access
• intitle:endymion.sak?.mail.login.page | inurl:sake.servlet
• intitle:Group-Office “Enter your username and password to login”
• intitle:ilohamail ”
• IlohaMail”
• intitle:ilohamail intext:”Version 0.8.10? ”
• IlohaMail”
• intitle:IMP inurl:imp/index.php3
• intitle:Login * Webmailer
• intitle:Login intext:”RT is ? Copyright”
• intitle:Node.List Win32.Version.3.11
• intitle:Novell intitle:WebAccess “Copyright *-* Novell, Inc”
• intitle:open-xchange inurl:login.pl
• intitle:Ovislink inurl:private/login
• intitle:phpnews.login
• intitle:plesk inurl:login.php3
• inurl:”/admin/configuration. php?” Mystore
• inurl:”/slxweb.dll/external?name=(custportal|webticketcust)”
• inurl:”1220/parse_xml.cgi?”
• inurl:”631/admin” (inurl:”op=*”) | (intitle:CUPS)
• inurl:”:10000? intext:webmin
• inurl:”Activex/default.htm” “Demo”
• inurl:”calendar.asp?action=login”
• inurl:”default/login.php” intitle:”kerio”
• inurl:”gs/adminlogin.aspx”
• inurl:”php121login.php”
• inurl:”suse/login.pl”
• inurl:”typo3/index.php?u=” -demo
• inurl:”usysinfo?login=true”
• inurl:”utilities/TreeView.asp”
• inurl:”vsadmin/login” | inurl:”vsadmin/admin” inurl:.php|.asp
• nurl:/admin/login.asp
• inurl:/cgi-bin/sqwebmail?noframes=1
• inurl:/Citrix/Nfuse17/
• inurl:/dana-na/auth/welcome.html
• inurl:/eprise/
• inurl:/Merchant2/admin.mv | inurl:/Merchant2/admin.mvc | intitle:”Miva Merchant Administration Login” -inurl:cheap-malboro.net
• inurl:/modcp/ intext:Moderator+vBulletin
• inurl:/SUSAdmin intitle:”Microsoft Software upd?t? Services”
• inurl:/webedit.* intext:WebEdit Professional -html
• inurl:1810 “Oracle Enterprise Manager”
• inurl:2000 intitle:RemotelyAnywhere -site:realvnc.com
• inurl::2082/frontend -demo
• inurl:administrator “welcome to mambo”
• inurl:bin.welcome.sh | inurl:bin.welcome.bat | intitle:eHealth.5.0
• inurl:cgi-bin/ultimatebb.cgi?ubb=login
• inurl:Citrix/MetaFrame/default/default.aspx
• inurl:confixx inurl:login|anmeldung
• inurl:coranto.cgi intitle:Login (Authorized Users Only)
• inurl:csCreatePro.cgi
• inurl:default.asp intitle:”WebCommander”
• inurl:exchweb/bin/auth/owalogon.asp
• inurl:gnatsweb.pl
• inurl:ids5web
• inurl:irc filetype:cgi cgi:irc
• inurl:login filetype:swf swf
• inurl:login.asp
• inurl:login.cfm
• inurl:login.php “SquirrelMail version”
• inurl:metaframexp/default/login.asp | intitle:”Metaframe XP Login”
• inurl:mewebmail
• inurl:names.nsf?opendatabase
• inurl:ocw_login_username
• inurl:orasso.wwsso_app_admin.ls_login
• inurl:postfixadmin intitle:”postfix admin” ext:php
• inurl:search/admin.php
• inurl:textpattern/index.php
• inurl:WCP_USER
• inurl:webmail./index.pl “Interface”
• inurl:webvpn.html “login” “Please enter your”
• Login (”
• Jetbox One CMS â?¢” | ”
• Jetstream ? *”)
• Novell NetWare intext:”netware management portal version”
• Outlook Web Access (a better way)
• PhotoPost PHP Upload
• PHPhotoalbum Statistics
• PHPhotoalbum Upload
• phpWebMail
• Please enter a valid password! inurl:polladmin
• INDEXU
• Ultima Online loginservers
• W-Nailer Upload Area
• intitle:”DocuShare” inurl:”docushare/dsweb/” -faq -gov -edu
• “#mysql dump” filetype:sql
• “#mysql dump” filetype:sql 21232f297a57a5a743894a0e4a801fc3
• “allow_call_time_pass_reference” “PATH_INFO”
• “Certificate Practice Statement” inurl:(PDF | DOC)
• “Generated by phpSystem”
• “generated by wwwstat”
• “Host Vulnerability Summary Report”
• “HTTP_FROM=googlebot” googlebot.com “Server_Software=”
• “Index of” / “chat/logs”
• “Installed Objects Scanner” inurl:default.asp
• “MacHTTP” filetype:log inurl:machttp.log
• “Mecury Version” “Infastructure Group”
• “Microsoft (R) Windows * (TM) Version * DrWtsn32 Copyright (C)” ext:log
• “Most Submitted Forms and s?ri?ts” “this section”
• “Network Vulnerability Assessment Report”
• “not for distribution” confidential
• “not for public release” -.edu -.gov -.mil
• “phone * * *” “address *” “e-mail” intitle:”curriculum vitae”
• “phpMyAdmin” “running on” inurl:”main.php”
• “produced by getstats”
• “Request Details” “Control Tree” “Server Variables”
• “robots.txt” “Disallow:” filetype:txt
• “Running in Child mode”
• “sets mode: +p”
• “sets mode: +s”
• “Thank you for your order” +receipt
• “This is a Shareaza Node”
• “This report was generated by WebLog”
• ( filetype:mail | filetype:eml | filetype:mbox | filetype:mbx ) intext:password|subject
• (intitle:”PRTG Traffic Grapher” inurl:”allsensors”)|(intitle:”PRTG Traffic Grapher – Monitoring Results”)
• (intitle:WebStatistica inurl:main.php) | (intitle:”WebSTATISTICA server”) -inurl:statsoft -inurl:statsoftsa -inurl:statsoftinc.com -edu -software -rob
• (inurl:”robot.txt” | inurl:”robots.txt” ) intext:disallow filetype:txt
• +”:8080? +”:3128? +”:80? filetype:txt
• +”HSTSNR” -”netop.com”
• -site:php.net -”The PHP Group” inurl:source inurl:url ext:pHp
• 94FBR “ADOBE PHOTOSHOP”
• AIM buddy lists
• allinurl:/examples/jsp/snp/snoop.jsp
• allinurl:cdkey.txt
• allinurl:servlet/SnoopServlet
• cgiirc.conf
• cgiirc.conf
• contacts ext:wml
• data filetype:mdb -site:gov -site:mil
• exported email addresses
• ext:(doc | pdf | xls | txt | ps | rtf | odt | sxw | psw | ppt | pps | xml) (intext:confidential salary | intext:”budget approved”) inurl:confidential
• ext:asp inurl:pathto.asp
• ext:ccm ccm -catacomb
• ext:CDX CDX
• ext:cgi inurl:editcgi.cgi inurl:file=
• ext:conf inurl:rsyncd.conf -cvs -man
• ext:conf NoCatAuth -cvs
• ext:dat bpk.dat
• ext:gho gho
• ext:ics ics
• ext:ini intext:env.ini
• ext:jbf jbf
• ext:ldif ldif
• ext:log “Software: Microsoft Internet Information Services *.*”
• ext:mdb inurl:*.mdb inurl:fpdb shop.mdb
• ext:nsf nsf -gov -mil
• ext:plist filetype:plist inurl:bookmarks.plist
• ext:pqi pqi -database
• ext:reg “username=*” putty
• ext:txt “Final encryption key”
• ext:txt inurl:dxdiag
• ext:vmdk vmdk
• ext:vmx vmx
• filetype:asp DBQ=” * Server.MapPath(“*.mdb”)
• filetype:bkf bkf
• filetype:blt “buddylist”
• filetype:blt blt +intext:screenname
• filetype:cfg auto_inst.cfg
• filetype:cnf inurl:_vti_pvt access.cnf
• filetype:conf inurl:firewall -intitle:cvs
• filetype:config web.config -CVS
• filetype:ctt Contact
• filetype:ctt ctt messenger
• filetype:eml eml +intext:”Subject” +intext:”From” +intext:”To”
• filetype:fp3 fp3
• filetype:fp5 fp5 -site:gov -site:mil -”cvs log”
• filetype:fp7 fp7
• filetype:inf inurl:capolicy.inf
• filetype:lic lic intext:key
• filetype:log access.log -CVS
• filetype:log cron.log
• filetype:mbx mbx intext:Subject
• filetype:myd myd -CVS
• filetype:ns1 ns1
• filetype:ora ora
• filetype:ora tnsnames
• filetype:pdb pdb backup (Pilot | Pluckerdb)
• filetype:php inurl:index inurl:phpicalendar -site:sourceforge.net
• filetype:pot inurl:john.pot
• filetype:PS ps
• filetype:pst inurl:”outlook.pst”
• filetype:pst pst -from -to -date
• filetype:qbb qbb
• filetype:QBW qbw
• filetype:rdp rdp
• filetype:reg “Terminal Server Client”
• filetype:vcs vcs
• filetype:wab wab
• filetype:xls -site:gov inurl:contact
• filetype:xls inurl:”email.xls”
• Financial spreadsheets: finance.xls
• Financial spreadsheets: finances.xls
• Ganglia Cluster Reports
• haccess.ctl (one way)
• haccess.ctl (VERY reliable)
• ICQ chat logs, please…
• intext:”Session Start * * * *:*:* *” filetype:log
• intext:”Tobias Oetiker” “traffic analysis”
• intext:(password | passcode) intext:(username | userid | user) filetype:csv
• intext:gmail invite intext:http://gmail.google.com/gmail/a
• intext:SQLiteManager inurl:main.php
• intext:ViewCVS inurl:Settings.php
• intitle:”admin panel” +”
• RedKernel”
• intitle:”Apache::Status” (inurl:server-status | inurl:status.html | inurl:apache.html)
• intitle:”AppServ Open Project” -site:www.appservnetwork.com
• intitle:”ASP Stats Generator *.*” “ASP Stats Generator” “2003-2004 weppos”
• intitle:”Big Sister” +”OK Attention Trouble”
• intitle:”curriculum vitae” filetype:doc
• intitle:”edna:streaming mp3 server” -forums
• intitle:”FTP root at”
• intitle:”index of” +myd size
• intitle:”Index Of” -inurl:maillog maillog size
• intitle:”Index Of” cookies.txt size
• intitle:”index of” mysql.conf OR mysql_config
• intitle:”Index of” upload size parent directory
• intitle:”index.of *” admin news.asp configview.asp
• intitle:”index.of” .diz .nfo last modified
• intitle:”Joomla – Web Installer”
• intitle:”LOGREP – Log file reporting system” -site:itefix.no
• intitle:”Multimon UPS status page”
• intitle:”PHP Advanced Transfer” (inurl:index.php | inurl:showrecent.php )
• intitle:”PhpMyExplorer” inurl:”index.php” -cvs
• intitle:”statistics of” “advanced web statistics”
• intitle:”System Statistics” +”System and Network Information Center”
• intitle:”urchin (5|3|admin)” ext:cgi
• intitle:”Usage Statistics for” “Generated by Webalizer”
• intitle:”wbem” compaq login “Compaq Information Technologies Group”
• intitle:”Web Server Statistics for ****”
• intitle:”web server status” SSH Telnet
• intitle:”Welcome to F-Secure Policy Manager Server Welcome Page”
• intitle:”welcome.to.squeezebox”
• intitle:admin intitle:login
• intitle:Bookmarks inurl:bookmarks.html “Bookmarks
• intitle:index.of “Apache” “server at”
• intitle:index.of cleanup.log
• intitle:index.of dead.letter
• intitle:index.of inbox
• intitle:index.of inbox dbx
• intitle:index.of ws_ftp.ini
• intitle:intranet inurl:intranet +intext:”phone”
• inurl:”/axs/ax-admin.pl” -s?ri?t
• inurl:”/cricket/grapher.cgi”
• inurl:”bookmark.htm”
• inurl:”cacti” +inurl:”graph_view.php” +”Settings Tree View” -cvs -RPM
• inurl:”newsletter/admin/”
• inurl:”newsletter/admin/” intitle:”newsletter admin”
• inurl:”putty.reg”
• inurl:”smb.conf” intext:”workgroup” filetype:conf conf
• inurl:*db filetype:mdb
• inurl:/cgi-bin/pass.txt
• inurl:/_layouts/settings
• inurl:admin filetype:xls
• inurl:admin intitle:login
• inurl:backup filetype:mdb
• inurl:build.err
• inurl:cgi-bin/printenv
• inurl:cgi-bin/testcgi.exe “Please distribute TestCGI”
• inurl:changepassword.asp
• inurl:ds.py
• inurl:email filetype:mdb
• inurl:fcgi-bin/echo
• inurl:forum filetype:mdb
• inurl:forward filetype:forward -cvs
• inurl:getmsg.html intitle:hotmail
• inurl:log.nsf -gov
• inurl:main.php phpMyAdmin
• inurl:main.php Welcome to phpMyAdmin
• inurl:netscape.hst
• inurl:netscape.hst
• inurl:netscape.ini
• inurl:odbc.ini ext:ini -cvs
• inurl:perl/printenv
• inurl:php.ini filetype:ini
• inurl:preferences.ini “[emule]”
• inurl:profiles filetype:mdb
• inurl:report “EVEREST Home Edition ”
• inurl:server-info “Apache Server Information”
• inurl:server-status “apache”
• inurl:snitz_forums_2000.mdb
• inurl:ssl.conf filetype:conf
• inurl:tdbin
• inurl:vbstats.php “page generated”
• inurl:wp-mail.php + “There doesn’t seem to be any new mail.”
• inurl:XcCDONTS.asp
• ipsec.conf
• ipsec.secrets
• ipsec.secrets
• Lotus Domino address books
• mail filetype:csv -site:gov intext:name
• Microsoft Money Data Files
• mt-db-pass.cgi files
• MySQL tabledata dumps
• mystuff.xml – Trillian data files
• OWA Public Folders (direct view)
• Peoples MSN contact lists
• php-addressbook “This is the addressbook for *” -warning
• phpinfo()
• phpMyAdmin dumps
• phpMyAdmin dumps
• private key files (.csr)
• private key files (.key)
• Quicken data files
• rdbqds -site:.edu -site:.mil -site:.gov
• robots.txt
• site:edu admin grades
• site:www.mailinator.com inurl:ShowMail.do
• SQL data dumps
• Squid cache server reports
• Unreal IRCd
• WebLog Referrers
• Welcome to ntop!
• Fichier contenant des informations sur le r?seau :
• filetype:log intext:”ConnectionManager2?
• “apricot – admin” 00h
• “by Reimar Hoven. All Rights Reserved. Disclaimer” | inurl:”log/logdb.dta”
• “Network Host Assessment Report” “Internet Scanner”
• “Output produced by SysWatch *”
• “Phorum Admin” “Database Connection” inurl:forum inurl:admin
• phpOpenTracker” Statistics
• “powered | performed by Beyond Security’s Automated Scanning” -kazaa -example
• “Shadow Security Scanner performed a vulnerability assessment”
• “SnortSnarf alert page”
• “The following report contains confidential information” vulnerability -search
• “The statistics were last upd?t?d” “Daily”-microsoft.com
• “this proxy is working fine!” “enter *” “URL***” * visit
• “This report lists” “identified by Internet Scanner”
• “Traffic Analysis for” “RMON Port * on unit *”
• “Version Info” “Boot Version” “Internet Settings”
• ((inurl:ifgraph “Page generated at”) OR (“This page was built using ifgraph”))
• Analysis Console for Incident Databases
• ext:cfg radius.cfg
• ext:cgi intext:”nrg-” ” This web page was created on ”
• filetype:pdf “Assessment Report” nessus
• filetype:php inurl:ipinfo.php “Distributed Intrusion Detection System”
• filetype:php inurl:nqt intext:”Network Query Tool”
• filetype:vsd vsd network -samples -examples
• intext:”Welcome to the Web V.Networks” intitle:”V.Networks [Top]” -filetype:htm
• intitle:”ADSL Configuration page”
• intitle:”Azureus : Java BitTorrent Client Tracker”
• intitle:”Belarc Advisor Current Profile” intext:”Click here for Belarc’s PC Management products, for large and small companies.”
• intitle:”BNBT Tracker Info”
• intitle:”Microsoft Site Server Analysis”
• intitle:”Nessus Scan Report” “This file was generated by Nessus”
• intitle:”PHPBTTracker Statistics” | intitle:”PHPBT Tracker Statistics”
• intitle:”Retina Report” “CONFIDENTIAL INFORMATION”
• intitle:”start.managing.the.device” remote pbx acc
• intitle:”sysinfo * ” intext:”Generated by Sysinfo * written by The Gamblers.”
• intitle:”twiki” inurl:”TWikiUsers”
• inurl:”/catalog.nsf” intitle:catalog
• inurl:”install/install.php”
• inurl:”map.asp?” intitle:”WhatsUp Gold”
• inurl:”NmConsole/Login.asp” | intitle:”Login – Ipswitch WhatsUp Professional 2005? | intext:”Ipswitch WhatsUp Professional 2005 (SP1)” “Ipswitch, Inc”
• inurl:”sitescope.html” intitle:”sitescope” intext:”refresh” -demo
• inurl:/adm-cfgedit.php
• inurl:/cgi-bin/finger? “In real life”
• inurl:/cgi-bin/finger? Enter (account|host|user|username)
• inurl:/counter/index.php intitle:”+PHPCounter 7.*”
• inurl:CrazyWWWBoard.cgi intext:”detailed debugging information”
• inurl:login.jsp.bak
• inurl:ovcgi/jovw
• inurl:phpSysInfo/ “created by phpsysinfo”
• inurl:portscan.php “from Port”|”Port Range”
• inurl:proxy | inurl:wpad ext:pac | ext:dat findproxyforurl
• inurl:statrep.nsf -gov
• inurl:status.cgi?host=all
• inurl:testcgi xitami
• inurl:webalizer filetype:png -.gov -.edu -.mil -opendarwin
• inurl:webutil.pl
• Looking Glass
• site:netcraft.com intitle:That.Site.Running Apache
• “A syntax error has occurred” filetype:ihtml
• “access denied for user” “using password”
• “An illegal character has been found in the statement” -”previous message”
• “ASP.NET_SessionId” “data source=”
• “Can’t connect to local” intitle:warning
• “Chatologica MetaSearch” “stack tracking”
• “detected an internal error [IBM][CLI Driver][DB2/6000]”
• “error found handling the request” cocoon filetype:xml
• “Fatal error: Call to undefined function” -reply -the -next
• “Incorrect syntax near”
• “Incorrect syntax near”
• “Internal Server Error” “server at”
• “Invision Power Board Database Error”
• “ORA-00933: SQL command not properly ended”
• “ORA-12541: TNS:no listener” intitle:”error occurred”
• “Parse error: parse error, unexpected T_VARIABLE” “on line” filetype:php
• “PostgreSQL query failed: ERROR: parser: parse error”
• “Supplied argument is not a valid MySQL result resource”
• “Syntax error in query expression ” -the
• “The s?ri?t whose uid is ” “is not allowed to access”
• “There seems to have been a problem with the” ” Please try again by clicking the Refresh button in your web browser.”
• “Unable to jump to row” “on MySQL result index” “on line”
• “Unclosed quotation mark before the character string”
• “Warning: Bad arguments to (join|implode) () in” “on line” -help -forum
• “Warning: Cannot modify header information – headers already sent”
• “Warning: Division by zero in” “on line” -forum
• 
  
• “Warning: mysql_connect(): Access denied for user: ‘*@*” “on line” -help -forum
• “Warning: mysql_query()” “invalid query”
• “Warning: pg_connect(): Unable to connect to PostgreSQL server: FATAL”
• “Warning: Supplied argument is not a valid File-Handle resource in”
• “Warning:” “failed to open stream: HTTP request failed” “on line”
• “Warning:” “SAFE MODE Restriction in effect.” “The s?ri?t whose uid is” “is not allowed to access owned by uid 0 in” “on line”
• “SQL Server Driver][SQL Server]Line 1: Incorrect syntax near”
• An unexpected token “END-OF-STATEMENT” was found
• Coldfusion Error Pages
• filetype:asp + “[ODBC SQL”
• filetype:asp “Custom Error Message” Category Source
• filetype:log “PHP Parse error” | “PHP Warning” | “PHP Error”
• filetype:php inurl:”logging.php” “Discuz” error
• ht://Dig htsearch error
• IIS 4.0 error messages
• IIS web server error messages
• Internal Server Error
• intext:”Error Message : Error loading required libraries.”
• intext:”Warning: Failed opening” “on line” “include_path”
• intitle:”Apache Tomcat” “Error Report”
• intitle:”Default PLESK Page”
• intitle:”Error Occurred While Processing Request” +WHERE (SELECT|INSERT) filetype:cfm
• intitle:”Error Occurred” “The error occurred in” filetype:cfm
• intitle:”Error using Hypernews” “Server Software”
• intitle:”Execution of this s?ri?t not permitted”
• intitle:”Under construction” “does not currently have”
• intitle:Configuration.File inurl:softcart.exe
• MYSQL error message: supplied argument….
• mysql error with query
• Netscape Application Server Error page
• ORA-00921: unexpected end of SQL command
• ORA-00921: unexpected end of SQL command
• ORA-00936: missing expression
• PHP application warnings failing “include_path”
• sitebuildercontent
• sitebuilderfiles
• sitebuilderpictures
• Snitz! forums db path error
• SQL syntax error
• Supplied argument is not a valid PostgreSQL result
• warning “error on line” php sablotron
• Windows 2000 web server error messages
• “ftp://” “www.eastgame.net”
• “html allowed” guestbook
• : vBulletin Version 1.1.5?
• “Select a database to view” intitle:”filemaker pro”
• “set up the administrator user” inurl:pivot
• “There are no Administrators Accounts” inurl:admin.php -mysql_fetch_row
• “Welcome to Administration” “General” “Local Domains” “SMTP Authentication” inurl:admin
• “Welcome to Intranet”
• “Welcome to PHP-Nuke” congratulations
• “Welcome to the Prestige Web-Based Configurator”
• “YaBB SE Dev Team”
• “you can now password” | “this is a special page only seen by you. your profile visitors” inurl:imchaos
• (“Indexed.By”|”Monitored.By”) hAcxFtpScan
• (inurl:/shop.cgi/page=) | (inurl:/shop.pl/page=)
• allinurl:”index.php” “site=sglinks”
• allinurl:install/install.php
• allinurl:intranet admin
• filetype:cgi inurl:”fileman.cgi”
• filetype:cgi inurl:”Web_Store.cgi”
• filetype:php inurl:vAuthenticate
• filetype:pl intitle:”Ultraboard Setup”
• Gallery in configuration mode
• Hassan Consulting’s Shopping Cart Version 1.18
• intext:”Warning: * am able * write ** configuration file” “includes/configure.php” -
• intitle:”Gateway Configuration Menu”
• intitle:”Horde :: My Portal” -”[Tickets”
• intitle:”Mail Server CMailServer Webmail” “5.2?
• intitle:”MvBlog powered”
• intitle:”Remote Desktop Web Connection”
• intitle:”Samba Web Administration Tool” intext:”Help Workgroup”
• intitle:”Terminal Services Web Connection”
• intitle:”Uploader – Uploader v6? -pixloads.com
• intitle:osCommerce inurl:admin intext:”redistributable under the GNU” intext:”Online Catalog” -demo -site:oscommerce.com
• intitle:phpMyAdmin “Welcome to phpMyAdmin ***” “running on * as root@*”
• intitle:phpMyAdmin “Welcome to phpMyAdmin ***” “running on * as root@*”
• inurl:”/NSearch/AdminServlet”
• inurl:”index.php? module=ew_filemanager”
• inurl:aol*/_do/rss_popup?blogID=
• inurl:footer.inc.php
• inurl:info.inc.php
• inurl:ManyServers.htm
• inurl:newsdesk.cgi? inurl:”t=”
• inurl:pls/admin_/gateway.htm
• inurl:rpSys.html
• inurl:search.php vbulletin
• inurl:servlet/webacc
• natterchat inurl:home.asp -site:natterchat.co.uk
• XOOPS Custom Installation
• inurl:htpasswd filetype:htpasswd
• inurl:yapboz_detay.asp + View Webcam User Accessing
• allinurl:control/multiview
• inurl:”ViewerFrame?Mode=”
• intitle:”WJ-NT104 Main Page”
• inurl:netw_tcp.shtml
• intitle:”supervisioncam protocol”
• 
  
• intitle:”Terminal Services Web Connection”
• intitle:”Uploader – Uploader v6? -pixloads.com
• intitle:osCommerce inurl:admin intext:”redistributable under the GNU” intext:”Online Catalog” -demo -site:oscommerce.com
• intitle:phpMyAdmin “Welcome to phpMyAdmin ***” “running on * as root@*”
• intitle:phpMyAdmin “Welco