GCSE (Google Custom Search Engine) - Tutorial

What are Google Dorks?

A Google Dork query, sometimes just referred to as a dork, is a search string that uses advanced search operators to find information that is not readily available on a website. Google Dorking, also known as Google hacking, can return information that is difficult to locate through simple search queries. This information is usually not intended for public viewing but has not been adequately protected.

Some examples of this information are: usernames and passwords, email lists, sensitive documents, personally identifiable financial information (PIFI) and website vulnerabilities. This information can be used for any number of illegal activities, including cyberterrorism, industrial espionage, identity theft and cyberstalking. A search parameter is a limitation applied to a search. Here are a few examples of advanced search parameters of a Google Ddork query:

• site: it returns files located on a particular website or domain.

• filetype: it is followed (without a space) by a file extension returns files of the specified type, such as DOC, PDF, XLS and INI. Multiple file types can be simultaneously searched by separating extensions with “|”.

• inurl: when followed by a particular string, it returns results with that sequence of characters in the URL.

• intext: when followed by a particular string, it returns files containing the string anywhere in the text.

Multiple search parameters can be combined, for example, to search for files of a certain type on a certain website or domain.

Some Examples

• Search for files containing passwords

  • "db.username" + "db.password" ext:properties

  • "anaconda-ks.cfg" | "ks.cfg" ext:cfg -git -gitlab

  • "/** MySQL database password */" ext:txt | ext:cfg | ext:env | ext:ini

• Search for vulnerable servers

  • intitle:"Wing FTP Server - Web"

  • "Powered by vBulletin Version 5.5.4"

  • intitle:"Wing FTP Server - Web"

• Search for files containing juicy info

  • intitle:"PowerMTA" inurl:logs

  • allintext:"index of" "oauth-private.key"

  • intitle:"index of" "mysql.log" | "mysql.logs"

  • "putty.log" ext:log | ext:cfg | ext:txt

There are more types of google dorks. Basically everything that could have been indexed inside Google can be searched using google dorks.

Google Dorks at HACKERMATE

Google Dorks frequently search for very specific information. Therefore, when one uses a Google dork just a few results are often returned. HM allows searching thousands of Google Dorks inside your scope so that a lot of potentially sensitive information and potentially vulnerable servers inside your scope are searched for.

Categories

HACKERMATE currenlty supports 2 configurations:

• Main Dorks: This configuration checks dorks related to vulnerabilities and high sensitive information.

• All Dorks - This configuration search for dorks related to vulnerabilities and any kind of sensitive information.

GCSE - Google Custom Search Engine

In order to take advantage of HM to search for all these thousands of Dorks within your scope , it is required to previously configure a Google Custom Search Engine.

The next paragraphs show how to configure a GCSE with your scope. Note that this configuration is completely free.

Firstly access https://programmablesearchengine.google.com/cse/create/new and, if you are not already logged in a gmail account, log in:

• In Sites to search enter all the domains inside your scope.

  • In this example hackermate.io, exmaple.com, domain.com and anotherdomain.com are configured.

• In Name of the search engine enter a name (it's recommended to put here the name of your scope)

  • In this example the name is HACKERMATE

Once you have introduce those values, press on CREATE

After entering those values, click CREATE. Then click "Modify your search engine Control Panel" in the following website:

Inside the Control Panel you can review the name and the introduced domains:

Here one can modify (Add or Delete) domains of the GCSE. Check that the shown domains match the domains that you want to subject to Dorking.

Important note: These domains must also be written in the scope provided to Hacker Mate.

Once you are happy with the entered domains check the following:

• Search the entire web is disabled:

WARNING: if enabled, it's very likely that you won't find results related to the entered domains

• Your search engine is available in Site Restricted JSON API:

  Your GCSE is available on Site Restricted JSON API if contains 10 domains or less. More info here.

WARNING: HACKERMATE uses the JSON Site restricted API, so if your GCSE is not available on Site Restricted JSON API, HM won't be able to search for dorks in your scope.

Once both requirements are met, copy the Search engine ID:

This is the GCSE ID that HACKERMATE is expecting as an input, so copy and paste it on the following box of HACKERMATE: