Google Hacking: When the search engine presents gaps and logs!

With Google Hacking, as with search engines in general, it is all about gathering information. Sometimes there is also talk of Google Dorking. This technique is used by attackers to use the sophisticated search technology of Google. Sophisticated search queries present security holes, error messages, sensitive information and data leaks directly in the search engine interface.

Attackers extend search queries for targeted victims and applications

As is often the case, you get thousands of results. To further narrow down the search, attackers also use information to reduce the number of people affected. This often includes the version number of the system they are looking for. But the search engine can also search for specific file types. With a simple search query, for example, all sql file types can be listed

filetype:sql

If you know the advanced search operators, you can also display other files. If you are looking for SMS logs, you need the following query:

intitle: "Index of" "sms.log"

Logical operators and symbols become power in Google.

As for the operators typical in computer science, you can also use Google and other search engines. Here AND, NOT and OR as well as operators like .... The following table contains additional information on these operators or possible combinations [table id=7 /]

Advanced search operators for Google Hacking

If you know the classical operators, you should take a look at the extended ones. These give the user another possibility to refine or filter the results. First, Google Search triggers the logical operators and then carries out the extended ones or further limits the result. With the search query

intitle:"index of" filetype:sql

the search engine will first look for

"index of"

in the title. The result is then narrowed down - only according to the file type sql. You can look up other operators and their purpose in the following table: [table id=8 /]

Can Google Hacking be prevented?

Basically Google Hacking is nothing else than (targeted) information gathering. By testing web applications and websites these misconfigurations are detected. The main aim of a pentest is to prevent the exploitation of the vulnerability by discovering the vulnerability beforehand. In the best case, the listing in search engines is also prevented or the correct configuration is provided. By the way, in our Live Hacking we show many user-friendly Google Hackings.