Google Hacking

Google hacking is a technique in which we make complex queries in Google in order to extract the information that we can use to hack website and many more stuff. Google hacking technique don't hack a website, but it provides information that assisst in hacking. This information is not available by making simple query in google.

Many people have misconsideration that in this technique we hack google.com, this is incorrect we don't hack google.com, no one does (after all it is a great search engine ;-) )

Before trying ur hand on google hacking I would like u to take care of some tips.

1. Don't use Google chrome for google hacking.

2. Open google.com now if u see ur email id on top right corner of ur browser then sign out first before performing google hacking.

3. Every website is not vulnerable to google hacking.

4. "|" used in google hacking means OR.

So now how to make complex queries. Complex queries are made by using google operators and ur innovation. There are several operators each have different function and give different result when used in google search query. But it depends upon ur thinking power that how u make a query to find specific results. You can also use more than one operator at a time.Lets start with all operators 1 by 1.

1. Site operator:

This operator is basically used for searching basic information about a target website.

type in google the following:

site:website address

Following is example to how to use it:

type site:yahoo.com in google and see the results. You can now see all the other domains of yahoo.com. you can use any site instead of yahoo.com

Howover u may be thinking this information is very common. But hackers uasually use this information to learn all the links of a site.

A long time before I tried site:hotmail.com in google query and i got so only 2 links in result. And u may not believe me that when I examined those urls they contained username and password. But when i tried to login those account it just failed.

2. intitle:index.of

This operator provides universal directory listing. It most works on apache based servers.

for this type follwoing in google:

intitle:index.of

you can also use it for specific websites like as following:

site:yahoo.com intitle:index.of

site:naukri.com intitle:index.of

3. Error|Warning

This operator can reveal gr8 information about target.This operator provide the information related to error that have occured on a website. This can reveal the applications used, OS etc of web server. Following must be entered in google:

intitle:error|warning

or try this

intitle:index.of intitle:error

for example enter the following in google and hit enter to see the results:

intitle:error

4. login|logon

This operator can reveal information regarding the login process. This operator can aslo reveal information containing email addresses, phone numbers or URLs of human assistants who can help who has trouble due to lost password. This assisstant help desk persons are perfect target of Social Engineering. Type the following in google:

login|logon

for example enter the following in google and search.

site:kreeda.com login|logon

5. Username|Userid|employe.id|your username is

This operator can be used to obtain username from target. You sholud use "your username is" string with intext operator. like intext:"your uesrname is"

Enter the follwoing code in Google:

username|userid|employee.id|your username is

if u get username then u can try to get the password of that site.

for example enter the following code to see in results u can get username of some persons:

site:myspace.com username|userid|employee.id|your username is

or

site:myspace.com intext:username|userid|employee.id|your username is

6. password|passcode|passkey|key|pwd|your password is

This operator can be used to reveal password from a website. It could also reveal the login authentication procedure. This query must used with site operator for specific results.

Enter the follwoing in google:

password|passcode|key|pwd|your password is

7. admin|administrator

This operator can get information about admin of website. However this operator give many irrevelant results too. Many times when error occurs we are provided with message to contact o administrator. So this query can also lead u too such results.

type followng in google:

admin|administrator

8. admin logon

This operator can reveal the admin login pages that is the page where admin logins a website.

However this operator needs to be used along with inurl operator for better results. like

inurl:admin logon

If u get password of admin then u can own a site.

9. -ext or filetype:

This operator is similar to operator filetype: Both operators can be used to get file os particular formats -ext is synonym of filetype: operator. -ext is -ve operator that means it wont give any result if used alone. So use it with site: operator like: site:website name -ext:pdf

In case of filetype: operator. For eg. if u want to get file of pdf format then type follwoing in google:

filetype:pdf

It will give u all pdf files. but if u want a specific pdf file like crypto.pdf then try following

code in google:

intext:crypto filetype:pdf

This operator is very important if u are looking for some specfic file on internet. eg. Suppose u want a file named crypto.mp3 from a specific website www.songslover.com then in order to find such file type u shall type follwoing code:

site:songslover.com intext:crypto filetype:mp3

This operator can be used to search books, software, songs, videos, games etc.

try this :

filetype:pdf intext:Hacking

The filetype: operator can aslo be used to get passwords. For example we can search specific registry files that can contain password. The password is usually in encrypted form or in hexadecimal.

type following in google:

filetype:reg intext:"internet account manager"

similarily u can extract passwords from a .mdb, .pwd and other database extension files.

try this:

filetype:pwd intext:"password is"|"passcode"

try this:

filetype:pwd inurl:_vti_pvt inurl:authors|administrators

10. inurl:temp|inurl:tmp|inurl:backup|inurl:bak

This operator basically searches for backup files on internet. This operator must be used with site: operator in order to find temperory or backup files of the target website. The temperory files and backup files can contain sensitive information.

The above query can also be written as inurl:temp|temperory|bak|backup

but remember when we use lots of OR's that is "|" in our query then we don't get much good results.

11. inurl:

This operator is also very useful one. Suppose u want to get the names of websites that contain a specific word. Then use this operator to assisst u. just type follwoing in google:

inurl:keyword

here keyword is the word that u want in url or web address.for eg. if I enter following in google:

inurl:crypto36

you can see it gives URLs that belong to my blogspot...!!!

Remember:

1. Avoid using lot of "|" in query.

2. The google hacking depends on ur thinking power & innovation. you can create ur own queries

by using different operators.

3. Every website is not vulnerable to google hacking. Besause of awareness of google hacking

many websites have started avoiding their specific pages to be displayed in google's result.

For example as i told u before the case of site:hotmail.com , now u wont find that result that i saw

year ago.

Here are some more queries that you can try. Type in google the following queries and see the results :

• admin account info” filetype:log
• !Host=*.* intext:enc_UserPassword=* ext:pcf
• “# -FrontPage-” ext:pwd inurl:(service | authors | administrators | users) “# -FrontPage-” inurl:service.pwd
• “AutoCreate=TRUE password=*”
• “http://*:*@www” domainname
• “index of/” “ws_ftp.ini” “parent directory”
• “liveice configuration file” ext:cfg -site:sourceforge.net
• “parent directory” +proftpdpasswd
• Duclassified” -site:duware.com “DUware All Rights reserved”
• duclassmate” -site:duware.com
• Dudirectory” -site:duware.com
• dudownload” -site:duware.com
• Elite Forum Version *.*”
• Link Department”
• “sets mode: +k”
• “your password is” filetype:log
• DUpaypal” -site:duware.com
• allinurl: admin mdb
• auth_user_file.txt
• config.php
• eggdrop filetype:user user
• enable password | secret “current configuration” -intext:the
• etc (index.of)
• ext:asa | ext:bak intext:uid intext:pwd -”uid..pwd” database | server | dsn
• ext:inc “pwd=” “UID=”
• ext:ini eudora.ini
• ext:ini Version=4.0.0.4 password
• ext:passwd -intext:the -sample -example
• ext:txt inurl:unattend.txt
• ext:yml database inurl:config
• filetype:bak createobject sa
• filetype:bak inurl:”htaccess|passwd|shadow|htusers”
• filetype:cfg mrtg “target
• filetype:cfm “cfapplication name” password
• filetype:conf oekakibbs
• filetype:conf slapd.conf
• filetype:config config intext:appSettings “User ID”
• filetype:dat “password.dat”
• filetype:dat inurl:Sites.dat
• filetype:dat wand.dat
• filetype:inc dbconn
• filetype:inc intext:mysql_connect
• filetype:inc mysql_connect OR mysql_pconnect
• filetype:inf sysprep
• filetype:ini inurl:”serv-u.ini”
• filetype:ini inurl:flashFXP.ini
• filetype:ini ServUDaemon
• filetype:ini wcx_ftp
• filetype:ini ws_ftp pwd
• filetype:ldb admin
• filetype:log “See `ipsec –copyright”
• filetype:log inurl:”password.log”
• filetype:mdb inurl:users.mdb
• filetype:mdb wwforum
• filetype:netrc password
• filetype:pass pass intext:userid
• filetype:pem intext:private
• filetype:properties inurl:db intext:password
• filetype:pwd service
• filetype:pwl pwl
• filetype:reg reg +intext:”defaultusername” +intext:”defaultpassword”
• filetype:reg reg +intext:â? WINVNC3â?
• filetype:reg reg HKEY_CURRENT_USER SSHHOSTKEYS
• filetype:sql “insert into” (pass|passwd|password)
• filetype:sql (“values * MD5? | “values * password” | “values * encrypt”)
• filetype:sql +”IDENTIFIED BY” -cvs
• filetype:sql password
• filetype:url +inurl:”ftp://” +inurl:”;@”
• filetype:xls username password email
• htpasswd
• htpasswd / htgroup
• htpasswd / htpasswd.bak
• intext:”enable password 7?
• intext:”enable secret 5 $”
• intext:”EZGuestbook”
• intext:”Web Wiz Journal”
• intitle:”index of” intext:connect.inc
• intitle:”index of” intext:globals.inc
• intitle:”Index of” passwords modified
• intitle:”Index of” sc_serv.conf sc_serv content
• intitle:”phpinfo()” +”mysql.default_password” +”Zend s?ri?ting Language Engine”
• intitle:dupics inurl:(add.asp | default.asp | view.asp | voting.asp) -site:duware.com
• intitle:index.of administrators.pwd
• intitle:Index.of etc shadow
• intitle:index.of intext:”secring.skr”|”secring.pgp”|”secring.bak”
• intitle:rapidshare intext:login
• inurl:”calendars?ri?t/users.txt”
• inurl:”editor/list.asp” | inurl:”database_editor.asp” | inurl:”login.asa” “are set”
• inurl:”GRC.DAT” intext:”password”
• inurl:”Sites.dat”+”PASS=”
• inurl:”slapd.conf” intext:”credentials” -manpage -”Manual Page” -man: -sample
• inurl:”slapd.conf” intext:”rootpw” -manpage -”Manual Page” -man: -sample
• inurl:”wvdial.conf” intext:”password”
• inurl:/db/main.mdb
• inurl:/wwwboard
• inurl:/yabb/Members/Admin.dat
• inurl:ccbill filetype:log
• inurl:cgi-bin inurl:calendar.cfg
• inurl:chap-secrets -cvs
• inurl:config.php dbuname dbpass
• inurl:filezilla.xml -cvs
• inurl:lilo.conf filetype:conf password -tatercounter2000 -bootpwd -man
• inurl:nuke filetype:sql
• inurl:ospfd.conf intext:password -sample -test -tutorial -download
• inurl:pap-secrets -cvs
• inurl:pass.dat
• inurl:perform filetype:ini
• inurl:perform.ini filetype:ini
• inurl:secring ext:skr | ext:pgp | ext:bak
• inurl:server.cfg rcon password
• inurl:ventrilo_srv.ini adminpassword
• inurl:vtund.conf intext:pass -cvs
• inurl:zebra.conf intext:password -sample -test -tutorial -download
• LeapFTP intitle:”index.of./” sites.ini modified
• master.passwd
• mysql history files
• NickServ registration passwords
• passlist
• passlist.txt (a better way)
• passwd
• passwd / etc (reliable)
• people.lst
• psyBNC config files
• pwd.db
• server-dbs “intitle:index of”
• signin filetype:url
• spwd.db / passwd
• trillian.ini
• wwwboard WebAdmin inurl:passwd.txt wwwboard|webadmin
• [WFClient] Password= filetype:ica
• intitle:”remote assessment” OpenAanval Console
• intitle:opengroupware.org “resistance is obsolete” “Report Bugs” “Username” “password”
• “bp blog admin” intitle:login | intitle:admin -site:johnny.ihackstuff.com
• “Emergisoft web applications are a part of our”
• “Establishing a secure Integrated Lights Out session with” OR intitle:”Data Frame – Browser not HTTP 1.1 compatible” OR intitle:”HP Integrated Lights-
• “HostingAccelerator” intitle:”login” +”Username” -”news” -demo
• “iCONECT 4.1 :: Login”
• “IMail Server Web Messaging” intitle:login
• “inspanel” intitle:”login” -”cannot” “Login ID” -site:inspediumsoft.com
• “intitle:3300 Integrated Communications Platform” inurl:main.htm
• “Login – Sun Cobalt RaQ”
• “login prompt” inurl:GM.cgi
• “Login to Usermin” inurl:20000
• “Microsoft CRM : Unsupported Browser Version”
• “OPENSRS Domain Management” inurl:manage.cgi
• “pcANYWHERE EXPRESS Java Client”
• “Please authenticate yourself to get access to the management interface”
• “please log in”
• “Please login with admin pass” -”leak” -sourceforge
• CuteNews” “2003..2005 CutePHP”
• DWMail” password intitle:dwmail
• Merak Mail Server Software” -.gov -.mil -.edu -site:merakmailserver.com
• Midmart Messageboard” “Administrator Login”
• Monster Top List” MTL numrange:200-
• UebiMiau” -site:sourceforge.net
• “site info for” “Enter Admin Password”
• “SquirrelMail version” “By the SquirrelMail development Team”
• “SysCP – login”
• “This is a restricted Access Server” “Javas?ri?t Not Enabled!”|”Messenger Express” -edu -ac
• “This section is for Administrators only. If you are an administrator then please”
• “ttawlogin.cgi/?action=”
• “VHCS Pro ver” -demo
• “VNC Desktop” inurl:5800
• “Web-Based Management” “Please input password to login” -inurl:johnny.ihackstuff.com
• “WebExplorer Server – Login” “Welcome to WebExplorer Server”
• “WebSTAR Mail – Please Log In”
• “You have requested access to a restricted area of our website. Please authenticate yourself to continue.”
• “You have requested to access the management functions” -.edu
• (intitle:”Please login – Forums
• UBB.threads”)|(inurl:login.php “ubb”)
• (intitle:”Please login – Forums
• WWWThreads”)|(inurl:”wwwthreads/login.php”)|(inurl:”wwwthreads/login.pl?Cat=”)
• (intitle:”rymo Login”)|(intext:”Welcome to rymo”) -family
• (intitle:”WmSC e-Cart Administration”)|(intitle:”WebMyStyle e-Cart Administration”)
• (inurl:”ars/cgi-bin/arweb?O=0? | inurl:arweb.jsp) -site:remedy.com -site:mil
• 4images Administration Control Panel
• allintitle:”Welcome to the Cyclades”
• allinurl:”exchange/logon.asp”
• allinurl:wps/portal/ login
• ASP.login_aspx “ASP.NET_SessionId”
• CGI:IRC Login
• ext:cgi intitle:”control panel” “enter your owner password to continue!”
• ez Publish administration
• filetype:php inurl:”webeditor.php”
• filetype:pl “Download: SuSE Linux Openexchange Server CA”
• filetype:r2w r2w
• intext:”"BiTBOARD v2.0? BiTSHiFTERS Bulletin Board”
• intext:”Fill out the form below completely to change your password and user name. If new username is left blank, your old one will be assumed.” -edu
• intext:”Mail admins login here to administrate your domain.”
• intext:”Master Account” “Domain Name” “Password” inurl:/cgi-bin/qmailadmin
• intext:”Master Account” “Domain Name” “Password” inurl:/cgi-bin/qmailadmin
• intext:”Storage Management Server for” intitle:”Server Administration”
• intext:”Welcome to” inurl:”cp” intitle:”H-SPHERE” inurl:”begin.html” -Fee
• intext:”vbulletin” inurl:admincp
• intitle:”*- HP WBEM Login” | “You are being prompted to provide login account information for *” | “Please provide the information requested and press
• intitle:”Admin Login” “admin login” “blogware”
• intitle:”Admin login” “Web Site Administration” “Copyright”
• intitle:”AlternC Desktop”
• intitle:”Athens Authentication Point”
• intitle:”b2evo > Login form” “Login form. You must log in! You will have to accept cookies in order to log in” -demo -site:b2evolution.net
• intitle:”Cisco CallManager User Options Log On” “Please enter your User ID and Password in the spaces provided below and click the Log On button to co
• intitle:”ColdFusion Administrator Login”
• intitle:”communigate pro * *” intitle:”entrance”
• intitle:”Content Management System” “user name”|”password”|”admin” “Microsoft IE 5.5? -mambo
• intitle:”Content Management System” “user name”|”password”|”admin” “Microsoft IE 5.5? -mambo
• intitle:”Dell Remote Access Controller”
• intitle:”Docutek ERes – Admin Login” -edu
• intitle:”Employee Intranet Login”
• intitle:”eMule *” intitle:”- Web Control Panel” intext:”Web Control Panel” “Enter your password here.”
• intitle:”ePowerSwitch Login”
• intitle:”eXist Database Administration” -demo
• intitle:”EXTRANET * – Identification”
• intitle:”EXTRANET login” -.edu -.mil -.gov
• intitle:”EZPartner” -netpond
• intitle:”Flash Operator Panel” -ext:php -wiki -cms -inurl:asternic -inurl:sip -intitle:ANNOUNCE -inurl:lists
• intitle:”i-secure v1.1? -edu
• intitle:”Icecast Administration Admin Page”
• intitle:”iDevAffiliate – admin” -demo
• intitle:”ISPMan : Unauthorized Access prohibited”
• intitle:”ITS System Information” “Please log on to the SAP System”
• intitle:”Kurant Corporation StoreSense” filetype:bok
• intitle:”ListMail Login” admin -demo
• intitle:”Login -
• Easy File Sharing Web Server”
• intitle:”Login Forum
• AnyBoard” intitle:”If you are a new user:” intext:”Forum
• AnyBoard” inurl:gochat -edu
• intitle:”Login to @Mail” (ext:pl | inurl:”index”) -dwaffleman
• intitle:”Login to Cacti”
• intitle:”Login to the forums – @www.aimoo.com” inurl:login.cfm?id=
• intitle:”MailMan Login”
• intitle:”Member Login” “NOTE: Your browser must have cookies enabled in order to log into the site.” ext:php OR ext:cgi
• intitle:”Merak Mail Server Web Administration” -ihackstuff.com
• intitle:”microsoft certificate services” inurl:certsrv
• intitle:”MikroTik RouterOS Managing Webpage”
• intitle:”MX Control Console” “If you can’t remember”
• intitle:”Novell Web Services” “GroupWise” -inurl:”doc/11924? -.mil -.edu -.gov -filetype:pdf
• intitle:”Novell Web Services” intext:”Select a service and a language.”
• intitle:”oMail-admin Administration – Login” -inurl:omnis.ch
• intitle:”OnLine Recruitment Program – Login”
• intitle:”Philex 0.2*” -s?ri?t -site:freelists.org
• intitle:”PHP Advanced Transfer” inurl:”login.php”
• intitle:”php icalendar administration” -site:sourceforge.net
• intitle:”php icalendar administration” -site:sourceforge.net
• intitle:”phpPgAdmin – Login” Language
• intitle:”PHProjekt – login” login password
• intitle:”please login” “your password is *”
• intitle:”Remote Desktop Web Connection” inurl:tsweb
• intitle:”SFXAdmin – sfx_global” | intitle:”SFXAdmin – sfx_local” | intitle:”SFXAdmin – sfx_test”
• intitle:”SHOUTcast Administrator” inurl:admin.cgi
• intitle:”site administration: please log in” “site designed by emarketsouth”
• intitle:”Supero Doctor III” -inurl:supermicro
• intitle:”SuSE Linux Openexchange Server” “Please activate Javas?ri?t!”
• intitle:”teamspeak server-administration
• intitle:”Tomcat Server Administration”
• intitle:”TOPdesk ApplicationServer”
• intitle:”TUTOS Login”
• intitle:”TWIG Login”
• intitle:”vhost” intext:”vHost . 2000-2004?
• intitle:”Virtual Server Administration System”
• intitle:”VisNetic WebMail” inurl:”/mail/”
• intitle:”VitalQIP IP Management System”
• intitle:”VMware Management Interface:” inurl:”vmware/en/”
• intitle:”VNC viewer for Java”
• intitle:”web-cyradm”|”by Luc de Louw” “This is only for authorized users” -tar.gz -site:web-cyradm.org
• intitle:”WebLogic Server” intitle:”Console Login” inurl:console
• intitle:”Welcome Site/User Administrator” “Please select the language” -demos
• intitle:”Welcome to Mailtraq WebMail”
• intitle:”welcome to netware *” -site:novell.com
• intitle:”WorldClient” intext:”? (2003|2004) Alt-N Technologies.”
• intitle:”xams 0.0.0..15 – Login”
• intitle:”XcAuctionLite” | “DRIVEN BY XCENT” Lite inurl:admin
• intitle:”XMail Web Administration Interface” intext:Login intext:password
• intitle:”Zope Help System” inurl:HelpSys
• intitle:”ZyXEL Prestige Router” “Enter password”
• intitle:”inc. vpn 3000 concentrator”
• intitle:(“TrackerCam Live Video”)|(“TrackerCam Application Login”)|(“Trackercam Remote”) -trackercam.com
• intitle:asterisk.management.portal web-access
• intitle:endymion.sak?.mail.login.page | inurl:sake.servlet
• intitle:Group-Office “Enter your username and password to login”
• intitle:ilohamail ”
• IlohaMail”
• intitle:ilohamail intext:”Version 0.8.10? ”
• IlohaMail”
• intitle:IMP inurl:imp/index.php3
• intitle:Login * Webmailer
• intitle:Login intext:”RT is ? Copyright”
• intitle:Node.List Win32.Version.3.11
• intitle:Novell intitle:WebAccess “Copyright *-* Novell, Inc”
• intitle:open-xchange inurl:login.pl
• intitle:Ovislink inurl:private/login
• intitle:phpnews.login
• intitle:plesk inurl:login.php3
• inurl:”/admin/configuration. php?” Mystore
• inurl:”/slxweb.dll/external?name=(custportal|webticketcust)”
• inurl:”1220/parse_xml.cgi?”
• inurl:”631/admin” (inurl:”op=*”) | (intitle:CUPS)
• inurl:”:10000? intext:webmin
• inurl:”Activex/default.htm” “Demo”
• inurl:”calendar.asp?action=login”
• inurl:”default/login.php” intitle:”kerio”
• inurl:”gs/adminlogin.aspx”
• inurl:”php121login.php”
• inurl:”suse/login.pl”
• inurl:”typo3/index.php?u=” -demo
• inurl:”usysinfo?login=true”
• inurl:”utilities/TreeView.asp”
• inurl:”vsadmin/login” | inurl:”vsadmin/admin” inurl:.php|.asp
• nurl:/admin/login.asp
• inurl:/cgi-bin/sqwebmail?noframes=1
• inurl:/Citrix/Nfuse17/
• inurl:/dana-na/auth/welcome.html
• inurl:/eprise/
• inurl:/Merchant2/admin.mv | inurl:/Merchant2/admin.mvc | intitle:”Miva Merchant Administration Login” -inurl:cheap-malboro.net
• inurl:/modcp/ intext:Moderator+vBulletin
• inurl:/SUSAdmin intitle:”Microsoft Software upd?t? Services”
• inurl:/webedit.* intext:WebEdit Professional -html
• inurl:1810 “Oracle Enterprise Manager”
• inurl:2000 intitle:RemotelyAnywhere -site:realvnc.com
• inurl::2082/frontend -demo
• inurl:administrator “welcome to mambo”
• inurl:bin.welcome.sh | inurl:bin.welcome.bat | intitle:eHealth.5.0
• inurl:cgi-bin/ultimatebb.cgi?ubb=login
• inurl:Citrix/MetaFrame/default/default.aspx
• inurl:confixx inurl:login|anmeldung
• inurl:coranto.cgi intitle:Login (Authorized Users Only)
• inurl:csCreatePro.cgi
• inurl:default.asp intitle:”WebCommander”
• inurl:exchweb/bin/auth/owalogon.asp
• inurl:gnatsweb.pl
• inurl:ids5web
• inurl:irc filetype:cgi cgi:irc
• inurl:login filetype:swf swf
• inurl:login.asp
• inurl:login.cfm
• inurl:login.php “SquirrelMail version”
• inurl:metaframexp/default/login.asp | intitle:”Metaframe XP Login”
• inurl:mewebmail
• inurl:names.nsf?opendatabase
• inurl:ocw_login_username
• inurl:orasso.wwsso_app_admin.ls_login
• inurl:postfixadmin intitle:”postfix admin” ext:php
• inurl:search/admin.php
• inurl:textpattern/index.php
• inurl:WCP_USER
• inurl:webmail./index.pl “Interface”
• inurl:webvpn.html “login” “Please enter your”
• Login (”
• Jetbox One CMS â?¢” | ”
• Jetstream ? *”)
• Novell NetWare intext:”netware management portal version”
• Outlook Web Access (a better way)
• PhotoPost PHP Upload
• PHPhotoalbum Statistics
• PHPhotoalbum Upload
• phpWebMail
• Please enter a valid password! inurl:polladmin
• INDEXU
• Ultima Online loginservers
• W-Nailer Upload Area
• intitle:”DocuShare” inurl:”docushare/dsweb/” -faq -gov -edu
• “#mysql dump” filetype:sql
• “#mysql dump” filetype:sql 21232f297a57a5a743894a0e4a801fc3
• “allow_call_time_pass_reference” “PATH_INFO”
• “Certificate Practice Statement” inurl:(PDF | DOC)
• “Generated by phpSystem”
• “generated by wwwstat”
• “Host Vulnerability Summary Report”
• “HTTP_FROM=googlebot” googlebot.com “Server_Software=”
• “Index of” / “chat/logs”
• “Installed Objects Scanner” inurl:default.asp
• “MacHTTP” filetype:log inurl:machttp.log
• “Mecury Version” “Infastructure Group”
• “Microsoft (R) Windows * (TM) Version * DrWtsn32 Copyright (C)” ext:log
• “Most Submitted Forms and s?ri?ts” “this section”
• “Network Vulnerability Assessment Report”
• “not for distribution” confidential
• “not for public release” -.edu -.gov -.mil
• “phone * * *” “address *” “e-mail” intitle:”curriculum vitae”
• “phpMyAdmin” “running on” inurl:”main.php”
• “produced by getstats”
• “Request Details” “Control Tree” “Server Variables”
• “robots.txt” “Disallow:” filetype:txt
• “Running in Child mode”
• “sets mode: +p”
• “sets mode: +s”
• “Thank you for your order” +receipt
• “This is a Shareaza Node”
• “This report was generated by WebLog”
• ( filetype:mail | filetype:eml | filetype:mbox | filetype:mbx ) intext:password|subject
• (intitle:”PRTG Traffic Grapher” inurl:”allsensors”)|(intitle:”PRTG Traffic Grapher – Monitoring Results”)
• (intitle:WebStatistica inurl:main.php) | (intitle:”WebSTATISTICA server”) -inurl:statsoft -inurl:statsoftsa -inurl:statsoftinc.com -edu -software -rob
• (inurl:”robot.txt” | inurl:”robots.txt” ) intext:disallow filetype:txt
• +”:8080? +”:3128? +”:80? filetype:txt
• +”HSTSNR” -”netop.com”
• -site:php.net -”The PHP Group” inurl:source inurl:url ext:pHp
• 94FBR “ADOBE PHOTOSHOP”
• AIM buddy lists
• allinurl:/examples/jsp/snp/snoop.jsp
• allinurl:cdkey.txt
• allinurl:servlet/SnoopServlet
• cgiirc.conf
• cgiirc.conf
• contacts ext:wml
• data filetype:mdb -site:gov -site:mil
• exported email addresses
• ext:(doc | pdf | xls | txt | ps | rtf | odt | sxw | psw | ppt | pps | xml) (intext:confidential salary | intext:”budget approved”) inurl:confidential
• ext:asp inurl:pathto.asp
• ext:ccm ccm -catacomb
• ext:CDX CDX
• ext:cgi inurl:editcgi.cgi inurl:file=
• ext:conf inurl:rsyncd.conf -cvs -man
• ext:conf NoCatAuth -cvs
• ext:dat bpk.dat
• ext:gho gho
• ext:ics ics
• ext:ini intext:env.ini
• ext:jbf jbf
• ext:ldif ldif
• ext:log “Software: Microsoft Internet Information Services *.*”
• ext:mdb inurl:*.mdb inurl:fpdb shop.mdb
• ext:nsf nsf -gov -mil
• ext:plist filetype:plist inurl:bookmarks.plist
• ext:pqi pqi -database
• ext:reg “username=*” putty
• ext:txt “Final encryption key”
• ext:txt inurl:dxdiag
• ext:vmdk vmdk
• ext:vmx vmx
• filetype:asp DBQ=” * Server.MapPath(“*.mdb”)
• filetype:bkf bkf
• filetype:blt “buddylist”
• filetype:blt blt +intext:screenname
• filetype:cfg auto_inst.cfg
• filetype:cnf inurl:_vti_pvt access.cnf
• filetype:conf inurl:firewall -intitle:cvs
• filetype:config web.config -CVS
• filetype:ctt Contact
• filetype:ctt ctt messenger
• filetype:eml eml +intext:”Subject” +intext:”From” +intext:”To”
• filetype:fp3 fp3
• filetype:fp5 fp5 -site:gov -site:mil -”cvs log”
• filetype:fp7 fp7
• filetype:inf inurl:capolicy.inf
• filetype:lic lic intext:key
• filetype:log access.log -CVS
• filetype:log cron.log
• filetype:mbx mbx intext:Subject
• filetype:myd myd -CVS
• filetype:ns1 ns1
• filetype:ora ora
• filetype:ora tnsnames
• filetype:pdb pdb backup (Pilot | Pluckerdb)
• filetype:php inurl:index inurl:phpicalendar -site:sourceforge.net
• filetype:pot inurl:john.pot
• filetype:PS ps
• filetype:pst inurl:”outlook.pst”
• filetype:pst pst -from -to -date
• filetype:qbb qbb
• filetype:QBW qbw
• filetype:rdp rdp
• filetype:reg “Terminal Server Client”
• filetype:vcs vcs
• filetype:wab wab
• filetype:xls -site:gov inurl:contact
• filetype:xls inurl:”email.xls”
• Financial spreadsheets: finance.xls
• Financial spreadsheets: finances.xls
• Ganglia Cluster Reports
• haccess.ctl (one way)
• haccess.ctl (VERY reliable)
• ICQ chat logs, please…
• intext:”Session Start * * * *:*:* *” filetype:log
• intext:”Tobias Oetiker” “traffic analysis”
• intext:(password | passcode) intext:(username | userid | user) filetype:csv
• intext:gmail invite intext:http://gmail.google.com/gmail/a
• intext:SQLiteManager inurl:main.php
• intext:ViewCVS inurl:Settings.php
• intitle:”admin panel” +”
• RedKernel”
• intitle:”Apache::Status” (inurl:server-status | inurl:status.html | inurl:apache.html)
• intitle:”AppServ Open Project” -site:www.appservnetwork.com
• intitle:”ASP Stats Generator *.*” “ASP Stats Generator” “2003-2004 weppos”
• intitle:”Big Sister” +”OK Attention Trouble”
• intitle:”curriculum vitae” filetype:doc
• intitle:”edna:streaming mp3 server” -forums
• intitle:”FTP root at”
• intitle:”index of” +myd size
• intitle:”Index Of” -inurl:maillog maillog size
• intitle:”Index Of” cookies.txt size
• intitle:”index of” mysql.conf OR mysql_config
• intitle:”Index of” upload size parent directory
• intitle:”index.of *” admin news.asp configview.asp
• intitle:”index.of” .diz .nfo last modified
• intitle:”Joomla – Web Installer”
• intitle:”LOGREP – Log file reporting system” -site:itefix.no
• intitle:”Multimon UPS status page”
• intitle:”PHP Advanced Transfer” (inurl:index.php | inurl:showrecent.php )
• intitle:”PhpMyExplorer” inurl:”index.php” -cvs
• intitle:”statistics of” “advanced web statistics”
• intitle:”System Statistics” +”System and Network Information Center”
• intitle:”urchin (5|3|admin)” ext:cgi
• intitle:”Usage Statistics for” “Generated by Webalizer”
• intitle:”wbem” compaq login “Compaq Information Technologies Group”
• intitle:”Web Server Statistics for ****”
• intitle:”web server status” SSH Telnet
• intitle:”Welcome to F-Secure Policy Manager Server Welcome Page”
• intitle:”welcome.to.squeezebox”
• intitle:admin intitle:login
• intitle:Bookmarks inurl:bookmarks.html “Bookmarks
• intitle:index.of “Apache” “server at”
• intitle:index.of cleanup.log
• intitle:index.of dead.letter
• intitle:index.of inbox
• intitle:index.of inbox dbx
• intitle:index.of ws_ftp.ini
• intitle:intranet inurl:intranet +intext:”phone”
• inurl:”/axs/ax-admin.pl” -s?ri?t
• inurl:”/cricket/grapher.cgi”
• inurl:”bookmark.htm”
• inurl:”cacti” +inurl:”graph_view.php” +”Settings Tree View” -cvs -RPM
• inurl:”newsletter/admin/”
• inurl:”newsletter/admin/” intitle:”newsletter admin”
• inurl:”putty.reg”
• inurl:”smb.conf” intext:”workgroup” filetype:conf conf
• inurl:*db filetype:mdb
• inurl:/cgi-bin/pass.txt
• inurl:/_layouts/settings
• inurl:admin filetype:xls
• inurl:admin intitle:login
• inurl:backup filetype:mdb
• inurl:build.err
• inurl:cgi-bin/printenv
• inurl:cgi-bin/testcgi.exe “Please distribute TestCGI”
• inurl:changepassword.asp
• inurl:ds.py
• inurl:email filetype:mdb
• inurl:fcgi-bin/echo
• inurl:forum filetype:mdb
• inurl:forward filetype:forward -cvs
• inurl:getmsg.html intitle:hotmail
• inurl:log.nsf -gov
• inurl:main.php phpMyAdmin
• inurl:main.php Welcome to phpMyAdmin
• inurl:netscape.hst
• inurl:netscape.hst
• inurl:netscape.ini
• inurl:odbc.ini ext:ini -cvs
• inurl:perl/printenv
• inurl:php.ini filetype:ini
• inurl:preferences.ini “[emule]”
• inurl:profiles filetype:mdb
• inurl:report “EVEREST Home Edition ”
• inurl:server-info “Apache Server Information”
• inurl:server-status “apache”
• inurl:snitz_forums_2000.mdb
• inurl:ssl.conf filetype:conf
• inurl:tdbin
• inurl:vbstats.php “page generated”
• inurl:wp-mail.php + “There doesn’t seem to be any new mail.”
• inurl:XcCDONTS.asp
• ipsec.conf
• ipsec.secrets
• ipsec.secrets
• Lotus Domino address books
• mail filetype:csv -site:gov intext:name
• Microsoft Money Data Files
• mt-db-pass.cgi files
• MySQL tabledata dumps
• mystuff.xml – Trillian data files
• OWA Public Folders (direct view)
• Peoples MSN contact lists
• php-addressbook “This is the addressbook for *” -warning
• phpinfo()
• phpMyAdmin dumps
• phpMyAdmin dumps
• private key files (.csr)
• private key files (.key)
• Quicken data files
• rdbqds -site:.edu -site:.mil -site:.gov
• robots.txt
• site:edu admin grades
• site:www.mailinator.com inurl:ShowMail.do
• SQL data dumps
• Squid cache server reports
• Unreal IRCd
• WebLog Referrers
• Welcome to ntop!
• Fichier contenant des informations sur le r?seau :
• filetype:log intext:”ConnectionManager2?
• “apricot – admin” 00h
• “by Reimar Hoven. All Rights Reserved. Disclaimer” | inurl:”log/logdb.dta”
• “Network Host Assessment Report” “Internet Scanner”
• “Output produced by SysWatch *”
• “Phorum Admin” “Database Connection” inurl:forum inurl:admin
• phpOpenTracker” Statistics
• “powered | performed by Beyond Security’s Automated Scanning” -kazaa -example
• “Shadow Security Scanner performed a vulnerability assessment”
• “SnortSnarf alert page”
• “The following report contains confidential information” vulnerability -search
• “The statistics were last upd?t?d” “Daily”-microsoft.com
• “this proxy is working fine!” “enter *” “URL***” * visit
• “This report lists” “identified by Internet Scanner”
• “Traffic Analysis for” “RMON Port * on unit *”
• “Version Info” “Boot Version” “Internet Settings”
• ((inurl:ifgraph “Page generated at”) OR (“This page was built using ifgraph”))
• Analysis Console for Incident Databases
• ext:cfg radius.cfg
• ext:cgi intext:”nrg-” ” This web page was created on ”
• filetype:pdf “Assessment Report” nessus
• filetype:php inurl:ipinfo.php “Distributed Intrusion Detection System”
• filetype:php inurl:nqt intext:”Network Query Tool”
• filetype:vsd vsd network -samples -examples
• intext:”Welcome to the Web V.Networks” intitle:”V.Networks [Top]” -filetype:htm
• intitle:”ADSL Configuration page”
• intitle:”Azureus : Java BitTorrent Client Tracker”
• intitle:”Belarc Advisor Current Profile” intext:”Click here for Belarc’s PC Management products, for large and small companies.”
• intitle:”BNBT Tracker Info”
• intitle:”Microsoft Site Server Analysis”
• intitle:”Nessus Scan Report” “This file was generated by Nessus”
• intitle:”PHPBTTracker Statistics” | intitle:”PHPBT Tracker Statistics”
• intitle:”Retina Report” “CONFIDENTIAL INFORMATION”
• intitle:”start.managing.the.device” remote pbx acc
• intitle:”sysinfo * ” intext:”Generated by Sysinfo * written by The Gamblers.”
• intitle:”twiki” inurl:”TWikiUsers”
• inurl:”/catalog.nsf” intitle:catalog
• inurl:”install/install.php”
• inurl:”map.asp?” intitle:”WhatsUp Gold”
• inurl:”NmConsole/Login.asp” | intitle:”Login – Ipswitch WhatsUp Professional 2005? | intext:”Ipswitch WhatsUp Professional 2005 (SP1)” “Ipswitch, Inc”
• inurl:”sitescope.html” intitle:”sitescope” intext:”refresh” -demo
• inurl:/adm-cfgedit.php
• inurl:/cgi-bin/finger? “In real life”
• inurl:/cgi-bin/finger? Enter (account|host|user|username)
• inurl:/counter/index.php intitle:”+PHPCounter 7.*”
• inurl:CrazyWWWBoard.cgi intext:”detailed debugging information”
• inurl:login.jsp.bak
• inurl:ovcgi/jovw
• inurl:phpSysInfo/ “created by phpsysinfo”
• inurl:portscan.php “from Port”|”Port Range”
• inurl:proxy | inurl:wpad ext:pac | ext:dat findproxyforurl
• inurl:statrep.nsf -gov
• inurl:status.cgi?host=all
• inurl:testcgi xitami
• inurl:webalizer filetype:png -.gov -.edu -.mil -opendarwin
• inurl:webutil.pl
• Looking Glass
• site:netcraft.com intitle:That.Site.Running Apache
• “A syntax error has occurred” filetype:ihtml
• “access denied for user” “using password”
• “An illegal character has been found in the statement” -”previous message”
• “ASP.NET_SessionId” “data source=”
• “Can’t connect to local” intitle:warning
• “Chatologica MetaSearch” “stack tracking”
• “detected an internal error [IBM][CLI Driver][DB2/6000]”
• “error found handling the request” cocoon filetype:xml
• “Fatal error: Call to undefined function” -reply -the -next
• “Incorrect syntax near”
• “Incorrect syntax near”
• “Internal Server Error” “server at”
• “Invision Power Board Database Error”
• “ORA-00933: SQL command not properly ended”
• “ORA-12541: TNS:no listener” intitle:”error occurred”
• “Parse error: parse error, unexpected T_VARIABLE” “on line” filetype:php
• “PostgreSQL query failed: ERROR: parser: parse error”
• “Supplied argument is not a valid MySQL result resource”
• “Syntax error in query expression ” -the
• “The s?ri?t whose uid is ” “is not allowed to access”
• “There seems to have been a problem with the” ” Please try again by clicking the Refresh button in your web browser.”
• “Unable to jump to row” “on MySQL result index” “on line”
• “Unclosed quotation mark before the character string”
• “Warning: Bad arguments to (join|implode) () in” “on line” -help -forum
• “Warning: Cannot modify header information – headers already sent”
• “Warning: Division by zero in” “on line” -forum
• 
  
• “Warning: mysql_connect(): Access denied for user: ‘*@*” “on line” -help -forum
• “Warning: mysql_query()” “invalid query”
• “Warning: pg_connect(): Unable to connect to PostgreSQL server: FATAL”
• “Warning: Supplied argument is not a valid File-Handle resource in”
• “Warning:” “failed to open stream: HTTP request failed” “on line”
• “Warning:” “SAFE MODE Restriction in effect.” “The s?ri?t whose uid is” “is not allowed to access owned by uid 0 in” “on line”
• “SQL Server Driver][SQL Server]Line 1: Incorrect syntax near”
• An unexpected token “END-OF-STATEMENT” was found
• Coldfusion Error Pages
• filetype:asp + “[ODBC SQL”
• filetype:asp “Custom Error Message” Category Source
• filetype:log “PHP Parse error” | “PHP Warning” | “PHP Error”
• filetype:php inurl:”logging.php” “Discuz” error
• ht://Dig htsearch error
• IIS 4.0 error messages
• IIS web server error messages
• Internal Server Error
• intext:”Error Message : Error loading required libraries.”
• intext:”Warning: Failed opening” “on line” “include_path”
• intitle:”Apache Tomcat” “Error Report”
• intitle:”Default PLESK Page”
• intitle:”Error Occurred While Processing Request” +WHERE (SELECT|INSERT) filetype:cfm
• intitle:”Error Occurred” “The error occurred in” filetype:cfm
• intitle:”Error using Hypernews” “Server Software”
• intitle:”Execution of this s?ri?t not permitted”
• intitle:”Under construction” “does not currently have”
• intitle:Configuration.File inurl:softcart.exe
• MYSQL error message: supplied argument….
• mysql error with query
• Netscape Application Server Error page
• ORA-00921: unexpected end of SQL command
• ORA-00921: unexpected end of SQL command
• ORA-00936: missing expression
• PHP application warnings failing “include_path”
• sitebuildercontent
• sitebuilderfiles
• sitebuilderpictures
• Snitz! forums db path error
• SQL syntax error
• Supplied argument is not a valid PostgreSQL result
• warning “error on line” php sablotron
• Windows 2000 web server error messages
• “ftp://” “www.eastgame.net”
• “html allowed” guestbook
• : vBulletin Version 1.1.5?
• “Select a database to view” intitle:”filemaker pro”
• “set up the administrator user” inurl:pivot
• “There are no Administrators Accounts” inurl:admin.php -mysql_fetch_row
• “Welcome to Administration” “General” “Local Domains” “SMTP Authentication” inurl:admin
• “Welcome to Intranet”
• “Welcome to PHP-Nuke” congratulations
• “Welcome to the Prestige Web-Based Configurator”
• “YaBB SE Dev Team”
• “you can now password” | “this is a special page only seen by you. your profile visitors” inurl:imchaos
• (“Indexed.By”|”Monitored.By”) hAcxFtpScan
• (inurl:/shop.cgi/page=) | (inurl:/shop.pl/page=)
• allinurl:”index.php” “site=sglinks”
• allinurl:install/install.php
• allinurl:intranet admin
• filetype:cgi inurl:”fileman.cgi”
• filetype:cgi inurl:”Web_Store.cgi”
• filetype:php inurl:vAuthenticate
• filetype:pl intitle:”Ultraboard Setup”
• Gallery in configuration mode
• Hassan Consulting’s Shopping Cart Version 1.18
• intext:”Warning: * am able * write ** configuration file” “includes/configure.php” -
• intitle:”Gateway Configuration Menu”
• intitle:”Horde :: My Portal” -”[Tickets”
• intitle:”Mail Server CMailServer Webmail” “5.2?
• intitle:”MvBlog powered”
• intitle:”Remote Desktop Web Connection”
• intitle:”Samba Web Administration Tool” intext:”Help Workgroup”
• intitle:”Terminal Services Web Connection”
• intitle:”Uploader – Uploader v6? -pixloads.com
• intitle:osCommerce inurl:admin intext:”redistributable under the GNU” intext:”Online Catalog” -demo -site:oscommerce.com
• intitle:phpMyAdmin “Welcome to phpMyAdmin ***” “running on * as root@*”
• intitle:phpMyAdmin “Welcome to phpMyAdmin ***” “running on * as root@*”
• inurl:”/NSearch/AdminServlet”
• inurl:”index.php? module=ew_filemanager”
• inurl:aol*/_do/rss_popup?blogID=
• inurl:footer.inc.php
• inurl:info.inc.php
• inurl:ManyServers.htm
• inurl:newsdesk.cgi? inurl:”t=”
• inurl:pls/admin_/gateway.htm
• inurl:rpSys.html
• inurl:search.php vbulletin
• inurl:servlet/webacc
• natterchat inurl:home.asp -site:natterchat.co.uk
• XOOPS Custom Installation
• inurl:htpasswd filetype:htpasswd
• inurl:yapboz_detay.asp + View Webcam User Accessing
• allinurl:control/multiview
• inurl:”ViewerFrame?Mode=”
• intitle:”WJ-NT104 Main Page”
• inurl:netw_tcp.shtml
• intitle:”supervisioncam protocol”
• 
  
• intitle:”Terminal Services Web Connection”
• intitle:”Uploader – Uploader v6? -pixloads.com
• intitle:osCommerce inurl:admin intext:”redistributable under the GNU” intext:”Online Catalog” -demo -site:oscommerce.com
• intitle:phpMyAdmin “Welcome to phpMyAdmin ***” “running on * as root@*”
• intitle:phpMyAdmin “Welco