How to Find Passwords in Exposed Log Files with Google Dorks « Null Byte :: WonderHowTo

You may not have thought of dorks as powerful, but with the right dorks, you can hack devices just by Googling the password to log in. Because Google is fantastic at indexing everything connected to the internet, it's possible to find files that are exposed accidentally and contain critical information for anyone to see.The advanced application ofGoogle search operatorsis Google Dorking — using search operators to hunt for specific vulnerable devices through targeted search strings. If we assume that Google has indexed most devices accidentally exposed to the internet, we can use the text we know appears in their login or administrative pages to find them.What Kinds of Things Do Dorks Connect to the Internet?You would be amazed. Everything from the pool controller of Yachts in the ocean to configuration interfaces for critical systems is connected to the internet by well-meaning people with the assumption that no one will ever find them.So how could this happen to you? Imagine getting a new security camera that provides the ability to watch it on your phone whenever you want. You set it up, connect it to your Wi-Fi, and download an app that asks for you to sign in. After that, you can access your camera from anywhere!What's going on in the background isn't so simple. The camera calls a Chinese server and streams video in real-time, allowing you to log in by accessing the video feed hosted on the server in China from your phone. That server may require no password to access the feed from your webcam, making your camera accessible to anyone who searches for text contained in the viewing page of the camera.Unfortunately, Google is ruthlessly effective at hunting down any devices on the internet running HTTP and HTTPS servers. Because most of these devices host a server to configure them, it means that many things that aren't supposed to be on Google end up there.Don't Miss:Use Photon Scanner to Scrape Web OSINT DataWhich Dorks Are the Most Powerful?By far, the most severe kind of exposed file we can find is one that leaks the credentials to user accounts or the entire service itself. Usually, this will happen in one of two ways. In the first, a server or other service is set up incorrectly and exposes its administrative logs to the internet. When passwords are changed, or a user fails to log in correctly, these logs can leak the credentials being used to the internet.The other way this happens is when configuration files that contain the same information are exposed. These are files that are supposed to be internal but are often leave critical information out in the open. Either one of these mistakes can cause the entire service to be taken over by an attacker who happens to chance upon the information.We'll be using Google dorks to find not only these files, but also things like file transfer servers that may contain interesting information, email lists, and my personal favorite, exposed webcams.Don't Miss:Use SpiderFoot for OSINT GatheringWhat You'll NeedTo follow along, you'll need a browser with internet access. The beautiful thing about using Google dorks is that we can use tools accessible by nearly anyone to find vulnerable systems.Once you have a browser open, navigate to Google.com, and we can get started.Don't Miss:Use the Buscador OSINT VM for Conducting Online InvestigationsStep 1: Finding FTP Servers & Websites Using HTTPTo start, we'll use the following dork to search for file transfer servers published sometime this year. Searching for these servers can allow us to find files that are supposed to be internal, but were unknowingly made public.intitle:"index of" inurl:ftp after:2018These servers become public because the index file of their FTP server is the kind of data that Google loves to scan — a fact people tend to forget. Google's scanning leads to a complete list of all the files contained within the server being searchable on Google.If we want to find insecure webpages still using HTTP to poke at, we can modify the command slightly to do so by changing the "ftp" to "http" and re-running the search.intitle:"index of" inurl:http after:2018Searching that string should produce a list of lots and lots of websites using HTTP, ready to be attacked. But if we're looking for a specific type of site, we can go even further.If we want to start attacking some easy targets, we can be more specific and search for online forms still using HTTP by changing the text in the search title.intitle:"forum" inurl:http after:2018We can keep adding search operators likeAND inurl:"registration"to get more specific and hunt down the registration pages of insecure form websites.Here you can see we've found a list of vulnerable online forums using HTTP.Step 1: Find Log Files with PasswordsThe next step will be to search for files of the .LOG type. Searching for LOG files will allow us to look for clues about what the credentials to the system or various user or admin accounts might be.The dork we'll be using to do this is as follows.allintext:password filetype:log after:2018When searching for current log files exposed to the internet, we find this almost immediately.This log states that the password is the default one, which takes just a simple Google search of the OpenCast Project website to discover. With one search, we've possibly found the credentials to this system without hacking anything at all.Step 2: Find Configuration Files with PasswordsConfiguration files should not be public pretty much ever, and .ENV files are great examples of this. If we search for .ENV files that contain a string for the database password, we instantly find the password to this database we've discovered.filetype:env "DB_PASSWORD" after:2018If we remove theafter:2018we can see older log files also exposing services to the internet.Step 3: Find Email ListsEmail lists are a great way of scraping email addresses and trying to find information on corporate or school targets. These lists are frequently exposed by companies or schools that are trying to organize email lists for their members.To find them, we'll be looking for spreadsheet .XLS file type with the string "email.xls" in the URL.While these results are useful, be careful not to download any file without first considering if it's a honeypot. Many people will take popular dorks and then leave a server hosting a file that looks vulnerable but could instead contain malware.Don't Miss:Use Facial Recognition to Conduct OSINT Analysis on Individuals & CompaniesStep 4: Find Open CamerasFinally, if you thought Shodan was the only service that can find weird open cameras, you were dead wrong. Camera login and viewing pages are usually HTTP, meaning Google is happy to index them and provide them for viewing if you know the right search string.One common format for webcam strings is searching for "top.htm" in the URL with the current time and date included. You'll find a lot of results this way.inurl:top.htm inurl:currenttimeThe first result is a webcam that appears to be the Windows XP background from another angle in Belmullet, Ireland.Another dork for cameras that produces outstanding results searches for a common live-view page hosted on routers.inurl:"lvappl.htm"Using this dork, I was able to locate the best camera of all, the birdcam1.Please do not hack the bird cam, but feel free toenjoy it here. Many other cameras are available, though all are less interesting than birdcam1.Many cameras also monitor inside factories or industrial areas.While you can view the cameras I demonstrated without a password; many dorks look for webcam login pages that have a well-known default password. This tactic, while illegal, allows easy access to many webcams not intended for public viewing.Google Dorks Allow Easy Hacking of Exposed ServicesThanks to the way Google indexes nearly everything connected to the internet that offers a web interface, there's no shortage of misconfigured services that leave critical elements exposed to the internet. Make sure you don't log in to any of these services even if the password is exposed, as this could get you into trouble because you don't have permission. If you have a service online, it's smart to run a few common dorks on your domains to see what turns up, just in case you've accidentally left something exposed that a hacker might find useful.I hope you enjoyed this guide to using Google dorks to find vulnerable devices and passwords! If you have any questions about this on Google dorks, or if you have a comment, ask below or feel free to reach me on Twitter@KodyKinzie.Don't Miss:Find Identifying Information from a Phone Number Using OSINT ToolsWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow To:Use Google to Hack(Googledorks)Hugging the Web (Part 3:The Google Bloodhound)How To:SQL Injection Finding Vulnerable Websites..How To:Find log-ins and passwords in Firefox 3 on a PC or MacBecome an Elite Hacker Part 4:Hacking a Website. [Part 1]How To:Have Your Friends Ever Used Pandora on Your Computer? Well, You Can Steal Their PasswordsHow To:Easily Bypass macOS High Sierra's Login Screen & Get Root (No Password Hacking Required)Hack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)How To:Use Dorkbot for Automated Vulnerability DiscoveryHow To:Use Your Saved Chrome Passwords to Log into Apps on Your GalaxyHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)How To:Enable Windows 10 Admin to Remove User Account Control PopupsHow To:Use Your Saved Passwords from Google Chrome to Log into Android AppsHow To:Use Google Search Operators to Find Elusive InformationHow To:Manage Stored Passwords So You Don't Get HackedHow To:Recover Passwords for Windows PCs Using OphcrackGoogle Dorking:AmIDoinItRite?Social Engineering, Part 2:Hacking a Friend's Facebook PasswordHow To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitHow To:Nab Free eBooks Using GoogleHow To:Search for Google+ Posts & Profiles with GoogleHow To:Safely Log In to Your SSH Account Without a PasswordHow To:Download Your Data with Google TakeoutHow To:Carve Saved Passwords Using CainHow To:log on Windows 7 with username & passwordGoodnight Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingHow To:Remove a Windows Password with a Linux Live CDHow To:Defend from Keyloggers in Firefox with Keystroke EncryptionHow To:An Entry Level Guide to Finding and Reading Logs (And Maybe Staying Out of Jail)Hack Logs and Linux Commands:What's Going On Here?Goodnight Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsHow To:Make Your Laptop Theft ProofHow To:Hack Mac OS X Lion PasswordsHow To:Sneak into Your Roommate's Computer by Bypassing the Windows Login ScreenHow To:Bypass Windows and Linux PasswordsNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsMastering Security, Part 1:How to Manage and Create Strong PasswordsHow To:Edit Your Google+ Account Settings