Google Hacking Using Commands
Not by Me But E-D Introduction
So, you are at the point where you understand exploiting, its possible you could get into any website you want into, and really all you want to do is have some fun playing around with stuff. Well this is the tutorial for you. This is what I do when I am sitting around, or feeling bored and wanting to find information or learn somthing new. Recently a friend of mine (ccc-88) aka Freeze. (which you will be hearing from and seeing alot more of soon) well anyways we found the manager of a proxy that was at a university and had pretty much complete control of the proxy, we had options to read any outgoing and incoming packets, view all the log information, view authentication information, etc etc. And we found all this, thats right, using google. So sit back, relax, you have learned alot, now it's time to have some fun.
Google commands
These are really not difficult to understand and memorize, in fact you may already know a few of these commands and be a step ahead of me. If you don't then you are in for some fun, this is not difficult and using this method to hack does not make you an uber 1337 hacker, lol. Anyways on to the commands.
filetype
Filetype can be used to only look for files with a specific extension. For example lets say you are looking for a song on google and you don't want to sort through pages, you would rather just have google list all mp3's that have to do with your search. In your search you would put:
filetype:mp3
Yeah its that simple, now google will only list mp3's. But you need more information than just that, such as details about what you are looking for. Then you would use the + and -.
+ and -
Plus and minus can be used to only list things that contain certain text or that does not have certain text. Let's assume again you are looking for a "50 cent" mp3 (50 cent is a rap artist for those that do not know). What you would do is use your knowledge of filetype but also use plus. Your search would look like this:
"+50 cent" filetype:mp3
Now the exact same works for the minus sign except it lists pages that do NOT contain the text. Get it? Got it? Good. Now we will get a bit more technical, stick with me because I am getting to the hacking part.
intitle
This is the command used to look between the <title> tags and </title> tags for certain text. Lets say you wanted to list all sites that had the word "Ham" in the title of the page, your search would look like this:
intitle:ham
Yeah that isn't that great but what about directory listing's? Such as index of... or management or administration or whatnot. Stick with me, just one more command and then I will peice this all together.
site
This is the command you use to only list sites based on their ending. Such as .com or .org or .edu or .gov or whatnot. If you only wanted to list .com's your search would contain this:
site:com
Not too hard eh? Got all the commands down? If not go through them again, they arent too hard to learn. Now on to the fun stuff.
Linking the information
Now if you are any good with php or have installed scripts before, have you ever seen a config file that had a .inc extension? Do you know the php code to connect to a mysql database, if not stick with me because you will understand soon. Lets say I put the following search into google:
"+mysql_connect" filetype:inc
What do you think I will get in return? That's right a huge list of .inc files, most of which are configuration files for php scripts on websites, now mysql_connect_db is the php code used to connect to a sql database with a username and password. Now if I tell google to only list pages with that in it, as I did above, I should recieve quite a few configuration files that list the MySQL database usernames and passwords and information right there in the file. Now play around, want to look for a database full of login ID's and passwords? No problem with google! simply do a quick run on this search:
"+login id" filetype:xls
XLS is the extension used for microsoft excel documents. :-D. I hope you have some fun with this, my other tutorials are kind of strict and somewhat boring so I decided to write one that you guys could have some fun with when youre just sitting around. Enjoy.
Not by Me But E-D
