ZZeo.
ZH
← Back to all posts
Web Vulnerability Reproduction and Analysis3 min read

Summary of Common Google Hacking Search Techniques

An overview of commonly used search engine syntax for information gathering during penetration testing, including examples for locating admin panels, educational targets, database errors, physical paths, database versions, and server probe files.

Published Apr 26, 2020
#Security
Read in Chinese→

Introduction

  • During penetration testing, using search engines for information gathering can be highly effective and often produces unexpected findings. It can also be used to search mirror repositories for information.
  • This article summarizes and shares some techniques I have previously encountered.

Commonly Used Syntax

site：可以限制你搜索范围的域名

inurl：用于搜索网页上包含的URL，这个语法对寻找网页上的搜索，帮助之类的很有用.

intext: 只搜索网页部分中包含的文字(也就是忽略了标题、URL等的文字)

intitle: 查包含关键词的页面，一般用于社工别人的webshell密码

filetype：搜索文件的后缀或者扩展名

intitle：限制你搜索的网页标题.

link: 可以得到一个所有包含了某个指定URL的页面列表.

Examples

Finding admin panel URLs: site:domain

这个真的好用
查看某公司的表格找账户：site:域名 filetype:xlsx
inurl:login|admin|manage|member|admin_login|login_admin|system|login|user|main|cms


查找文本内容：site:域名 intext:管理|后台|登陆|用户名|密码|验证码|系统|帐号|admin|login|sys|managetem|password|username


查找上传漏洞：site:域名 inurl:file|load|editor|Files**


找web编辑器：

site:域名 inurl:ewebeditor|editor|uploadfile|eweb|edit

存在的数据库：site:域名 filetype:mdb|asp|#

查看脚本类型：site:域名 filetype:asp/aspx/php/jsp

Common Queries for Educational Targets

site:xxx.edu.cn intext:student ID

site:xxx.edu.cn intext:default password

site:xxx.edu.cn intext:login/admin login/login management and other login pages

Look for various leftover database errors, physical paths, database versions, and server probe files.

site:*.tw  inurl:/phpinfo.php
filetype:log "PHP Parse error"| "PHP Warning"
site:*.tw  "id=" & intext:"Warning: mysql_fetch_array()
site:*.jp  "id=" & intext:"Warning: getimagesize()
site:*.br  "id=" & intext:"Warning: array_merge()
site:*.tw  "id=" & intext:"Warning: mysql_fetch_assoc()
site:*.tw  "id=" & intext:"Warning: mysql_result()
site:*.jp  "id=" & intext:"Warning: pg_exec()
site:*.tw  "id=" & intext:"Warning: require()
inurl:/robots.txt site:*.*
1 目录遍历漏洞  语法为: site:baidu.com intitle:index.of

2 配置文件泄露  语法为: site:baidu.com ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | extra | ext:ini

3 数据库文件泄露  site:baidu.com ext:sql | ext:dbf | ext:mdb

4 日志文件泄露 site:baidu.com ext:log

5 备份和历史文件 site:baidu.com ext:bkf | ext:bkp | ext:bak | extld | ext:backup

6 SQL错误  site:baidu.com intext:”sql syntax near” | intext:”syntax error has occurred” | intext:”incorrect syntax near” | intext:”unexpected end of SQL command” | intext:”Warning: mysql_connect()” | intext:”Warning: mysql_query()” | intext:”Warning: pg_connect()”

7 公开文件信息  site:baidu.com ext:doc | ext:docx | extdt | ext:pdf | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv

8  phpinfo()  site:baidu.com ext:php intitle:phpinfo “published by the PHP Group” 

9.不可靠程序透露的信息 

（1)php version： 

intitle:phpinfo

inurl:info.php

(2)程序中含有SQL注入漏洞并且路径可以修改弱口 

"advanced guestbook * powered":

inurl:addentry.php

intitle:"View img" inurl:viewimg.php

10.安全扫描报告 "Assessment report" "nessus": filetype:pdf

11.数据库程序和错误文件 

"Welcome to phpmyadmin ***" "running on * as root@*" intitle:phpmyadmin

"mysql error with query"

12.暴库

inurl:/inc/conn.asp 

inurl:/inc+conn.asp 

intext:to parent directory 目录遍历

inurl:/inc/conn.asp

inurl:/inc+conn.asp

intext:to parent directory+intext:mdb site:xxx.com