In this lesson, we're going to talk about
search engine analysis and enumeration.
Search engines can be a great tool
for recon and gathering intelligence
against a target organization.
Using search operators to reveal sensitive information
that an organization might have
unintentionally exposed online
is often referred to as Google hacking.
Despite its name, Google hacking
doesn't involve hacking Google servers.
It involves optimizing your searches
by using Google and other search engine operators
like quotation marks, the NOT operator,
AND/OR operators, scope,
and URL modifiers in special queries.
Let's begin by looking at operators
and how they impact searches within a search engine.
Using a double quotation mark
allows you to search for an exact phrase.
When you enclose a phrase in double quotes,
the search engine will only return results
that contain that exact phrase in that specific order.
This is useful when you're looking for specific text strings
or key phrases within web pages.
For example, if we searched for "security
assessment report"
the results would only include sites with that exact phrase.
The minus sign operator excludes specific terms
from your search results.
For instance, -login will search for content
that doesn't include pages containing the word login.
The AND/OR operators allow you to combine
or broaden your search queries.
Now, putting "Network" AND "vulnerability" in double quotes,
we have "Network" AND "Vulnerability"
returns results containing both network and vulnerability,
while the same thing having
"firewall" and "intrusion" detection and double quotes,
searching for "firewall" OR "intrusion detection"
returns results containing
either firewall or intrusion detection.
Scope modifiers restrict your search
to specific sites or URL structures,
making it easier to focus on relevant data.
For example, site:diontraining.com
limits the search to that specific domain
while intitle:"admin panel"
restrict searches to pages
with the exact phrase admin panel in the title.
inurl:login restricts searches to pages
with the keyword login in the URL.
Modifiers like filetype allows you
to filter results by specific file types.
This is particularly useful for finding sensitive documents
or reports that might be publicly available
but not intended for general viewing.
For example, filetype:pdf
"security report"
searches for PDF files
containing exact phrase "security report,"
while filetype:xls "financials"
finds Excel spreadsheets that contain the term financials.
The true power of Google hacking
and any use of search engines for pentesting,
lies in combining the operators to create precise queries.
For example, the query site:diontraining.com
filetype:pdf,
or filetype:docx "confidential report"
draft will search diontraining.com for
a PDF or a DOCX file
containing the phrase confidential report
but exclude any results labeled as draft.
Such documents can contain
a lot of useful information for an attacker.
In a similar fashion, using the search query
site:diotraining.com filetype:pdf
or filetype:docx
allows you to find PDF or DOCX files
within Dion Training's website,
potentially revealing important information
such as reports, internal documents,
or any technical specifications.
In addition to text-based searches,
reverse image searches can yield valuable information.
Tools like TinEye, Google Images, and Bing Visual Search
allow you to upload an image
or provide a URL to find similar images on the web.
This can help identify compromised images,
social media profiles,
or other publicly available visual content
that might not be immediately apparent
through regular searches.
Google alerts can be another useful tool
for monitoring changes or new content
related to a particular keyword.
For instance, you can set up alert
for Dion Training's name or email address.
Simply go to google.com/alerts, enter your keyword,
and customize the search options,
like frequency, language, and delivery method.
So, remember, effective search engine analysis
requires us not to use the right tools,
but also the right techniques.
By using quotes, NOT, AND/OR, scope,
and URL modifies strategically,
you can uncover valuable intelligence
that forms the foundation for your pentesting strategy.