Google Dorking for Ethical Hacking

Sep 19, 2024

Google Dorking Training Notes

Introduction

  • Course focuses on Google Dorking, aimed at ethical hackers.
  • Designed for beginners; can be watched at 1.3x or 1.5x speed for better understanding.
  • Training is for educational purposes only; aims to demonstrate how to find vulnerable servers without exploiting them.

What is Google Dorking?

  • Advanced search technique using Google.
  • Involves filtering search results.
  • Example: Searching for Tesla to find related websites.

Operators in Google Dorking

  1. Site Operator:

    • Example: site:tesla.com shows results only from tesla.com.

  2. Exclusion Operator:

    • Use - to exclude terms.
    • Example: tesla.com -www excludes results with www subdomain.

  3. Inurl Operator:

    • Identifies specific URLs.
    • Useful for finding specific login pages or sensitive information.

  4. Intitle Operator:

    • Searches for keywords in the title of pages.
    • Example: intitle:login to find login pages.

  5. Intext Operator:

    • Searches for keywords in the content of pages.
    • Example: intext:password to find pages containing the word "password."

  6. Filetype Operator:

    • Searches for specific file types.
    • Example: filetype:pdf to find PDF files.

  7. Link Operator:

    • Finds links associated with a specific domain.
    • Example: link:tesla.com shows external links pointing to tesla.com.

Practical Applications

  • Finding Login Pages: Using intitle and inurl to uncover login forms.
  • Finding Vulnerabilities: Searching for specific terms like index of to find directory listings.
  • Identifying Open Servers: Using combinations of operators to locate open FTP, Telnet, and RDP servers.

Google Dorking for Bug Bounty

  • Understand how to use dorking to identify potential vulnerabilities in web applications.
  • Example search for bug bounty reports: site:tesla.com intext:report to find existing reports about vulnerabilities.

Creating Custom Google Dorks

  • Use darksearch.com for pre-built dorks and create personalized searches.
  • Combining Operators: Layer different search operators to refine results and target specific vulnerabilities.

Conclusion

  • Regular practice of Google Dorking techniques enhances skills in penetration testing.
  • Encouraged to explore various operators and their combinations for effective searches.

Future Classes

  • Upcoming topics include subdomains, advanced Google Dorking, and vulnerability assessments.