Google Dorks: Finding Password Lists

[k0t0M]

maaf bang klo berbau repsol tinggal delete aja ..

Code:

filetype:htpasswd htpasswd
intitle:"Index of” “.htpasswd” -intitle:"dist” -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of om.passwd
inurlasslist.txt
intitle:"Index of..etc” passwd
intitle:admin intitle:login
“Incorrect syntax near” (SQL script error)
intitle:"the page cannot be found” inetmgr
intitle:index.of ws_ftp.ini
“Supplied arguments is not a valid PostgreSQL result” (possible debilidad SQL)
_vti_pvt password intitle:index.of (Frontpage)
inurl:backup intitle:index.of inurl:admin
“Index of /backup”
index.of.password
index.of.winnt

inurl:"auth_user_file.txt”
“Index of /admin”
“Index of /password”
“Index of /mail”
“Index of /” +passwd
Index of /” +.htaccess
Index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin”
allintitle: “index of/root”
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurlasswd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:"auth_user_file.txt”
inurl:"wwwroot/*.”
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"Index of” .sh_history
intitle:"Index of” .bash_history
intitle:"Index of” passwd
intitle:"Index of” people.1st
intitle:"Index of” pwd.db
intitle:"Index of” etc/shadow
intitle:"Index of” spwd
intitle:"Index of” om.passwd
intitle:"Index of” htpasswd
intitle:"Index of” members OR accounts
intitle:"Index of” user_carts OR user _cart

ini pesenan nya bang tabun

[anko_kum4ru]

lengkap deh..
izin praktek langsung omz..

[k0t0M]

ane nemu di forum negara bagian serikat bang

di modif lagi kali bisa nemu banyak bang

[hakimoxz]

wawa...............
thak's kak....katom

tambahan

Code:

http://pastebin.com/5YQ78v9q

Code:

Google Hacking

allintitle:Brains, Corp. camera

allintitle:"index of/admin"
allintitle:"index of/root"
allintitle:restricted filetype:doc site:gov
allintitle:restricted filetype :mail
allintitle:sensitive filetype:doc

allinurl:/bash_history
allinurl:winnt/system32/ (get cmd.exe)

ext:ini eudora.ini
ext:pwd inurl:(service|authors|administrators |users) "# -FrontPage-"

filetype:bak inurl:"htaccess|passwd|shadow|htusers"
filetype:conf slapd.conf
filetype:ctt "msn"
filetype:mdb inurl:"account|users|admin|administrators|passwd|password"
filetype:mdb inurl:users.mdb
filetype:QDF QDF
filetype:pdf "Host Vulnerability Summary Report" "Assessment Report"
filetype:sql ("passwd values ****" | "password values ****" | "pass values ****" )
filetype:xls inurl:"email.xls"
filetype:user eggdrop user

"Index of /admin"
"Index of /" +.htaccess
"Index of /mail"
"Index of /" "Parent Directory" "WS_FTP.ini" filetype:ini
"Index of /" +passwd
"Index of /password"
"Index of /" +password.txt
intext:"BiTBOARD v2.0" "BiTSHiFTERS Bulletin Board"
intext:centreware inurl:status
intext:"MOBOTIX M1"
intext:"MOBOTIX M10"
intext:"Open Menu"
intext:"powered by Web Wiz Journal"
intext:"Tobias Oetiker" "traffic analysis"

intitle:index.of "Apache/1.3.28 Server at"
intitle:index.of "Apache/2.0 Server at"
intitle:index.of "Apache/* Server at"
intitle:index.of "HP Apache-based Web Server/*"
intitle:index.of "IBM _ HTTP _ Server/* * Server at"
intitle:index.of "Microsoft-IIS/4.0 Server at"
intitle:index.of "Microsoft-IIS/5.0 Server at"
intitle:index.of "Microsoft-IIS/6.0 Server at"
intitle:index.of "Microsoft-IIS/* Server at"
intitle:index.of "Netscape/* Server at"
intitle:index.of "Oracle HTTP Server/* Server at"
intitle:index.of "Red Hat Secure/*"

intitle:"Apache::Status" (inurl:server-status | inurl:status.html | inurl:apache.html)
intitle:"Welcome to IIS 4.0!"
intitle:"Welcome to Windows 2000 Internet Services"
intitle:"Welcome to Windows XP Server Internet Services"
intitle:"Welcome to Your New Home Page!"
intitle:"Test Page for Apache Installation" "It worked!" "this Web site!"
intitle:"Test Page for Apache Installation" "Seeing this instead"
intitle:"Test Page for Apache Installation" "You are free"
intitle:"Test Page for the Apache Http Server on Fedora Core"
intitle:"Test Page for the Apache Web Server on RedHat Linux"
intitle:"Test Page for the SSL/TLS-aware Apache Installation" "Hey, it worked!"

intitle:"index of" .bash_history
intitle:"index of" etc/shadow
intitle:"index.of" finances.xls
intitle:"index of" htpasswd
intitle:"Index Of" inurl:maillog
intitle:"index of" om.passwd
intitle:"index of" members OR accounts
intitle:"index.of" mystuff.xml
intitle:"index of" passwd
intitle:"index of" people.lst
intitle:"index of" pwd.db
intitle:"Index of" pwd.db
intitle:"Index of" .sh_history
intitle:"index of" spwd
intitle:"index.of" trillian.ini
intitle:"index of" user_carts OR user_cart
intitle:"active webcam page"
intitle:"ASP Stats Generator *.*" "ASP Stats Generator" "2003-2004 weppos"
intitle:"curriculum vitae" "phone * * *" "address *"
intitle:"Dell Laser Printer" ews
intitle:"EvoCam" inurl:"webcam.html"
intitle:liveapplet inurl:LvAppl
intitle:"Multimon UPS status page"
intitle:"my webcamXP server!" inurl:":8080"
intitle:"statistics of" "advanced web statistics"
intitle:"System Statistics" +"System and Network Information Center"
intitle:"Terminal Services Web Connection"
intitle:"Usage Statistics for" "Generated by Webalizer"
intitle:"VNC Desktop" inurl:5800
intitle:"Web Server Statistics for ****"
inurl:admin filetype:db
inurl:admin inurl:backup intitle:index.of
inurl:"auth_user_file.txt"
inurl:"/axs/ax-admin.pl" -script
inurl:"/cricket/grapher.cgi"
inurl:hp/device/this.LCDispatcher
inurl:iisadmin
inurl:indexFrame.shtml Axis
inurl:"main.php" "phpMyAdmin" "running on"
inurl:passwd filetype:txt
inurl:"printer/main.html" intext:"settings"
inurl:server-info "Apache Server Information"
inurl:"ViewerFrame?Mode="
inurl:"wvdial.conf" intext:"password"
inurl:"wwwroot/*."

site:gov confidential
site:mil confidential
site:mil "top secret"
"Copyright (c) Tektronix, Inc." "printer status"
"Host Vulnerability Summary Report"
"http://*:*@www"
"Network Vulnerability Assessment Report"
"not for distribution"
"Output produced by SysWatch *"
"These statistics were produced by getstats"
"This file was generated by Nessus"
"This report was generated by WebLog"
"This summary was generated by wwwstat"
"Generated by phpSystem"
"Host Vulnerability Summary Report"
"my webcamXP server!"
sample/LvAppl/
"TOSHIBA Network Camera - User Login"
/home/homeJ.html
/ViewerFrame?Mode=Motion
This reveals mySQL database dumps. These database dumps list the structure and content of databases, which can reveal many different types of sensitive information. http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=%22%23mysql+dump%22+filetype%3Asql&btnG=Search

These log files record info about the SSH client PUTTY. These files contain usernames, site names, IP addresses, ports and various other information about the SSH server connected to. http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=filetype%3Alog+username+putty

These files contain cleartext usernames and passwords, as well as the sites associated with those credentials. Attackers can use this information to log on to that site as that user. http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=filetype%3Alog+inurl%3A%22password.log%22

This file contains port number, version number and path info to MySQL server. http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=intitle%3A%22index+of%22+mysql.conf+OR+mysql_config

This search reveals sites which may be using Shockwave (Flash) as a login mechanism for a site. The usernames and passwords for this type of login mechanism are often stored in plaintext inside the source of the .swl file. http://www.google.com/search?hl=en&lr=&q=inurl%3Alogin+filetype%3Aswf+swf

These are oulook express email files which contain emails, with full headers. The information in these emails can be useful for information gathering about a target. http://www.google.com/search?hl=en&lr=&q=filetype%3Aeml+eml+%2Bintext%3A%22Subject%22+%2Bintext%3A%22From%22+%2Bintext%3A%22To%22

This google search reveals users names, pop3 passwords, email addresses, servers connected to and more. The IP addresses of the users can also be revealed in some cases. http://www.google.com/search?num=100&hl=en&lr=&q=filetype%3Areg+reg+%2Bintext%3A%22internet+account+manager




Footprinting Websites and Information Gathering Resources

A hacker or pen tester  may also do a Google search or a site search to locate information about employees. Some sites useful to find more information about an organization and its employees include:

www.trula.com - real estate

www.zillow.com - real estate

www.netronline.com - real estate

www.whosarat.com - informants

www.zabaseach.com - name, address, location info

www.zoominfo.com - person & company data

www.vitalrec.com - people info

www.pipl.com - people search

www.skipease.com/blog/ - people search

www.pretrieve.com - people search

www.publicdata.com - people search

www.urapi.com - people search

https://addons.mozilla.org/en-US/firefox/addon/1912 (who is this person)

www.nndb.com – people activity tracker

www.willyancey.com/finding.htm  online info

www.courthousedirect.com  - property records

www.turboscout.com - multisearch engine tool

www.theultimates.com - phone number lookup

http://skipease.whitepages.com/reverse_address - address lookup

www.thevault.com - company search / profile

www.blogsearchengine.com - search blogs for info or person

www.ccrs.info - China based company search /profile

www.hoovers.com - company search / profile

www.lexisnexis.com - company search / profile

www.topix.net - region specific news articles

www.pacer.uscourts.gov/natsuit.html - Court records

www.oihweb.com - online investigation techniques

www.linkedin.com - business person's network


Footprinting Links

Google Hacking Database
A search that finds password hashes
Nessus Reports from Google
More Passwords from Google
Google Hacks Volume III by Halla
G-Zapper Blocks the Google Cookie to Search Anonymously
SiteDigger 2.0 searches Google’s cache to look for vulnerabilities
BeTheBot - View Pages as the Googlebot Sees Them
An experts-exchange page to demonstrate the Googlebot
HTTP Header Viewer
Masquerading Your Browser
User Agent Switcher :: Firefox Add-ons
Modify Headers :: Firefox Add-ons
User Agent Sniffer for Project 1
GNU Wget - Tool to Mirror Websites
Teleport Pro - Tool to Mirror Websites
Google Earth
Finding Subdomains (Zone Transfers)
Dakota Judge rules that Zone Transfers are Hacking
Internet Archive - Wayback Machine
Wikto - Web Server Assessment Tool - With Google Hacking
VeriSign Whois Search from VeriSign, Inc.
whois.com
ARIN: WHOIS Database Search
Border Gateway Protocol (BGP) and AS Numbers
Internic | Whois - the only one that finds hackthissite.org
Teenager admits eBay domain hijack
NeoTrace
VisualRoute traceroute: connection test, trace IP address, IP trace, IP address locations

[CitooZz]

om kotom

[Emily.Josan♫]

bang ,,
yang malay ada ga bang

[dev4]

ijin bookmark omz

(08-08-2011 02:53 AM)x_wungu Wrote:   bang ,,
yang malay ada ga bang

wew

[Wayc0de]

wah keren tuh

ijin coba ea

[ohara_inamiji]

hahaha,,,,,
saia suka dork


ijin icp-icip[/align]

[monkey dragon]

(08-08-2011 02:49 AM)hakimoxz Wrote:  wawa...............
thak's kak....katom

tambahan

Code:

http://pastebin.com/5YQ78v9q

Code:

Google Hacking

allintitle:Brains, Corp. camera

allintitle:"index of/admin"
allintitle:"index of/root"
allintitle:restricted filetype:doc site:gov
allintitle:restricted filetype :mail
allintitle:sensitive filetype:doc

allinurl:/bash_history
allinurl:winnt/system32/ (get cmd.exe)

ext:ini eudora.ini
ext:pwd inurl:(service|authors|administrators |users) "# -FrontPage-"

filetype:bak inurl:"htaccess|passwd|shadow|htusers"
filetype:conf slapd.conf
filetype:ctt "msn"
filetype:mdb inurl:"account|users|admin|administrators|passwd|password"
filetype:mdb inurl:users.mdb
filetype:QDF QDF
filetype:pdf "Host Vulnerability Summary Report" "Assessment Report"
filetype:sql ("passwd values ****" | "password values ****" | "pass values ****" )
filetype:xls inurl:"email.xls"
filetype:user eggdrop user

"Index of /admin"
"Index of /" +.htaccess
"Index of /mail"
"Index of /" "Parent Directory" "WS_FTP.ini" filetype:ini
"Index of /" +passwd
"Index of /password"
"Index of /" +password.txt
intext:"BiTBOARD v2.0" "BiTSHiFTERS Bulletin Board"
intext:centreware inurl:status
intext:"MOBOTIX M1"
intext:"MOBOTIX M10"
intext:"Open Menu"
intext:"powered by Web Wiz Journal"
intext:"Tobias Oetiker" "traffic analysis"

intitle:index.of "Apache/1.3.28 Server at"
intitle:index.of "Apache/2.0 Server at"
intitle:index.of "Apache/* Server at"
intitle:index.of "HP Apache-based Web Server/*"
intitle:index.of "IBM _ HTTP _ Server/* * Server at"
intitle:index.of "Microsoft-IIS/4.0 Server at"
intitle:index.of "Microsoft-IIS/5.0 Server at"
intitle:index.of "Microsoft-IIS/6.0 Server at"
intitle:index.of "Microsoft-IIS/* Server at"
intitle:index.of "Netscape/* Server at"
intitle:index.of "Oracle HTTP Server/* Server at"
intitle:index.of "Red Hat Secure/*"

intitle:"Apache::Status" (inurl:server-status | inurl:status.html | inurl:apache.html)
intitle:"Welcome to IIS 4.0!"
intitle:"Welcome to Windows 2000 Internet Services"
intitle:"Welcome to Windows XP Server Internet Services"
intitle:"Welcome to Your New Home Page!"
intitle:"Test Page for Apache Installation" "It worked!" "this Web site!"
intitle:"Test Page for Apache Installation" "Seeing this instead"
intitle:"Test Page for Apache Installation" "You are free"
intitle:"Test Page for the Apache Http Server on Fedora Core"
intitle:"Test Page for the Apache Web Server on RedHat Linux"
intitle:"Test Page for the SSL/TLS-aware Apache Installation" "Hey, it worked!"

intitle:"index of" .bash_history
intitle:"index of" etc/shadow
intitle:"index.of" finances.xls
intitle:"index of" htpasswd
intitle:"Index Of" inurl:maillog
intitle:"index of" om.passwd
intitle:"index of" members OR accounts
intitle:"index.of" mystuff.xml
intitle:"index of" passwd
intitle:"index of" people.lst
intitle:"index of" pwd.db
intitle:"Index of" pwd.db
intitle:"Index of" .sh_history
intitle:"index of" spwd
intitle:"index.of" trillian.ini
intitle:"index of" user_carts OR user_cart
intitle:"active webcam page"
intitle:"ASP Stats Generator *.*" "ASP Stats Generator" "2003-2004 weppos"
intitle:"curriculum vitae" "phone * * *" "address *"
intitle:"Dell Laser Printer" ews
intitle:"EvoCam" inurl:"webcam.html"
intitle:liveapplet inurl:LvAppl
intitle:"Multimon UPS status page"
intitle:"my webcamXP server!" inurl:":8080"
intitle:"statistics of" "advanced web statistics"
intitle:"System Statistics" +"System and Network Information Center"
intitle:"Terminal Services Web Connection"
intitle:"Usage Statistics for" "Generated by Webalizer"
intitle:"VNC Desktop" inurl:5800
intitle:"Web Server Statistics for ****"
inurl:admin filetype:db
inurl:admin inurl:backup intitle:index.of
inurl:"auth_user_file.txt"
inurl:"/axs/ax-admin.pl" -script
inurl:"/cricket/grapher.cgi"
inurl:hp/device/this.LCDispatcher
inurl:iisadmin
inurl:indexFrame.shtml Axis
inurl:"main.php" "phpMyAdmin" "running on"
inurl:passwd filetype:txt
inurl:"printer/main.html" intext:"settings"
inurl:server-info "Apache Server Information"
inurl:"ViewerFrame?Mode="
inurl:"wvdial.conf" intext:"password"
inurl:"wwwroot/*."

site:gov confidential
site:mil confidential
site:mil "top secret"
"Copyright (c) Tektronix, Inc." "printer status"
"Host Vulnerability Summary Report"
"http://*:*@www"
"Network Vulnerability Assessment Report"
"not for distribution"
"Output produced by SysWatch *"
"These statistics were produced by getstats"
"This file was generated by Nessus"
"This report was generated by WebLog"
"This summary was generated by wwwstat"
"Generated by phpSystem"
"Host Vulnerability Summary Report"
"my webcamXP server!"
sample/LvAppl/
"TOSHIBA Network Camera - User Login"
/home/homeJ.html
/ViewerFrame?Mode=Motion
This reveals mySQL database dumps. These database dumps list the structure and content of databases, which can reveal many different types of sensitive information. http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=%22%23mysql+dump%22+filetype%3Asql&btnG=Search

These log files record info about the SSH client PUTTY. These files contain usernames, site names, IP addresses, ports and various other information about the SSH server connected to. http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=filetype%3Alog+username+putty

These files contain cleartext usernames and passwords, as well as the sites associated with those credentials. Attackers can use this information to log on to that site as that user. http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=filetype%3Alog+inurl%3A%22password.log%22

This file contains port number, version number and path info to MySQL server. http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=intitle%3A%22index+of%22+mysql.conf+OR+mysql_config

This search reveals sites which may be using Shockwave (Flash) as a login mechanism for a site. The usernames and passwords for this type of login mechanism are often stored in plaintext inside the source of the .swl file. http://www.google.com/search?hl=en&lr=&q=inurl%3Alogin+filetype%3Aswf+swf

These are oulook express email files which contain emails, with full headers. The information in these emails can be useful for information gathering about a target. http://www.google.com/search?hl=en&lr=&q=filetype%3Aeml+eml+%2Bintext%3A%22Subject%22+%2Bintext%3A%22From%22+%2Bintext%3A%22To%22

This google search reveals users names, pop3 passwords, email addresses, servers connected to and more. The IP addresses of the users can also be revealed in some cases. http://www.google.com/search?num=100&hl=en&lr=&q=filetype%3Areg+reg+%2Bintext%3A%22internet+account+manager




Footprinting Websites and Information Gathering Resources

A hacker or pen tester  may also do a Google search or a site search to locate information about employees. Some sites useful to find more information about an organization and its employees include:

www.trula.com - real estate

www.zillow.com - real estate

www.netronline.com - real estate

www.whosarat.com - informants

www.zabaseach.com - name, address, location info

www.zoominfo.com - person & company data

www.vitalrec.com - people info

www.pipl.com - people search

www.skipease.com/blog/ - people search

www.pretrieve.com - people search

www.publicdata.com - people search

www.urapi.com - people search

https://addons.mozilla.org/en-US/firefox/addon/1912 (who is this person)

www.nndb.com – people activity tracker

www.willyancey.com/finding.htm  online info

www.courthousedirect.com  - property records

www.turboscout.com - multisearch engine tool

www.theultimates.com - phone number lookup

http://skipease.whitepages.com/reverse_address - address lookup

www.thevault.com - company search / profile

www.blogsearchengine.com - search blogs for info or person

www.ccrs.info - China based company search /profile

www.hoovers.com - company search / profile

www.lexisnexis.com - company search / profile

www.topix.net - region specific news articles

www.pacer.uscourts.gov/natsuit.html - Court records

www.oihweb.com - online investigation techniques

www.linkedin.com - business person's network


Footprinting Links

Google Hacking Database
A search that finds password hashes
Nessus Reports from Google
More Passwords from Google
Google Hacks Volume III by Halla
G-Zapper Blocks the Google Cookie to Search Anonymously
SiteDigger 2.0 searches Google’s cache to look for vulnerabilities
BeTheBot - View Pages as the Googlebot Sees Them
An experts-exchange page to demonstrate the Googlebot
HTTP Header Viewer
Masquerading Your Browser
User Agent Switcher :: Firefox Add-ons
Modify Headers :: Firefox Add-ons
User Agent Sniffer for Project 1
GNU Wget - Tool to Mirror Websites
Teleport Pro - Tool to Mirror Websites
Google Earth
Finding Subdomains (Zone Transfers)
Dakota Judge rules that Zone Transfers are Hacking
Internet Archive - Wayback Machine
Wikto - Web Server Assessment Tool - With Google Hacking
VeriSign Whois Search from VeriSign, Inc.
whois.com
ARIN: WHOIS Database Search
Border Gateway Protocol (BGP) and AS Numbers
Internic | Whois - the only one that finds hackthissite.org
Teenager admits eBay domain hijack
NeoTrace
VisualRoute traceroute: connection test, trace IP address, IP trace, IP address locations

ajib dah om