Evidence has been found of certain documents around the web holding passwords and other vital information that many probably don’t want revealed. Here is a list of interesting Google Dorks that uncover some of these documents. This is for purposes of your awareness only!
Facebook!
Many use such a google dork to find usernames and passwords of numerous accounts including Facebook!
The Dork: intext:charset_test= email= default_persistent=
Enter that into Google, and you will be presented with several sites that have username and passwords lists!
WordPress!
This will look for WordPress backup files containing the passwords, and all data for these sites!
The Dork: filetype:sql inurl:wp-content/backup-*
WWWBoard!
This will look for the user and passwords of WWWBoard users
The Dork: inurl:/wwwboard/passwd.txt
FrontPage!
This will find all users and passwords, similar to above.
The Dork: ext:pwd inurl:(service | authors | administrators | users) “# -FrontPage-”
Symfony!
This finds database information and logins
The Dork: inurl:config/databases.yml -trac -trunk -”Google Code” -source -repository
TeamSpeak! (big one!!!!!)
This will search for the server.dbs file (a Sqlite database file With the SuperAdmin username and password!!!)
The Dork: server-dbs “intitle:index of”
TeamSpeak2!!! (also big!)
This will find the log file which has the Super Admin user and pass in the Top 100 lines. Look for “superadmin account info:”
The Dork: “inurl:Teamspeak2_RC2/server.log”
Get Admin pass!
Simple dork which looks for all types of admin info
The Dork: “admin account info” filetype:log
Private keys! (not any more!)
This will find any .pem files which contain private keys.
The Dork: filetype:pem pem intext:private
And the Ultimate one, the regular directory full of passwords….
Simple one!
The Dork: intitle:”Index of..etc” passwd
Wrapup:
Now that you have seen some ways that people’s passwords are floating around the internet out in the open, you may want to use the knowledge to figure out your own vulnerabilities. You can use these dorks along with additional parameters, such as yourusername or inurl:yourdomain.com to make sure you are not vulnerable or already compromised.
Facebook!
Many use such a google dork to find usernames and passwords of numerous accounts including Facebook!
The Dork: intext:charset_test= email= default_persistent=
Enter that into Google, and you will be presented with several sites that have username and passwords lists!
WordPress!
This will look for WordPress backup files containing the passwords, and all data for these sites!
The Dork: filetype:sql inurl:wp-content/backup-*
WWWBoard!
This will look for the user and passwords of WWWBoard users
The Dork: inurl:/wwwboard/passwd.txt
FrontPage!
This will find all users and passwords, similar to above.
The Dork: ext:pwd inurl:(service | authors | administrators | users) “# -FrontPage-”
Symfony!
This finds database information and logins
The Dork: inurl:config/databases.yml -trac -trunk -”Google Code” -source -repository
TeamSpeak! (big one!!!!!)
This will search for the server.dbs file (a Sqlite database file With the SuperAdmin username and password!!!)
The Dork: server-dbs “intitle:index of”
TeamSpeak2!!! (also big!)
This will find the log file which has the Super Admin user and pass in the Top 100 lines. Look for “superadmin account info:”
The Dork: “inurl:Teamspeak2_RC2/server.log”
Get Admin pass!
Simple dork which looks for all types of admin info
The Dork: “admin account info” filetype:log
Private keys! (not any more!)
This will find any .pem files which contain private keys.
The Dork: filetype:pem pem intext:private
And the Ultimate one, the regular directory full of passwords….
Simple one!
The Dork: intitle:”Index of..etc” passwd
Wrapup:
Now that you have seen some ways that people’s passwords are floating around the internet out in the open, you may want to use the knowledge to figure out your own vulnerabilities. You can use these dorks along with additional parameters, such as yourusername or inurl:yourdomain.com to make sure you are not vulnerable or already compromised.
Tags
tecnologia