Operators of the Google search engine. PHP: Inheritance Inurl privat bild php name everyday

For each operator there is a lightweight version with a shorter name (without the prefix all). The difference is that allinurl will find links with all words, and inurl will only find links with the first of them. The second and subsequent words from the query can appear anywhere on web pages. The inurl operator also differs from another operator with a similar meaning - site. The first also allows you to find any sequence of characters in a link to the searched document (for example, /cgi-bin/), which is widely used to find components with known vulnerabilities.

Let's try it in practice. We take the allintext filter and make the request produce a list of numbers and verification codes of credit cards that will expire only in two years (or when their owners get tired of feeding everyone).

Allintext: card number expiration date /2017 cvv

When you read in the news that a young hacker “hacked into the servers” of the Pentagon or NASA, stealing classified information, in most cases we are talking about just such a basic technique of using Google. Suppose we are interested in a list of NASA employees and their contact information. Surely such a list is available in electronic form. For convenience or due to oversight, it may also be on the organization’s website itself. It is logical that in this case there will be no links to it, since it is intended for internal use. What words can be in such a file? At a minimum - the “address” field. Testing all these assumptions is easy.

Inurl:nasa.gov filetype:xlsx "address"

We use bureaucracy

Finds like this are a nice touch. A truly solid catch is provided by a more detailed knowledge of Google operators for webmasters, the Network itself and the peculiarities of the structure of what is being sought. Knowing the details, you can easily filter the results and refine the properties of the necessary files in order to get truly valuable data in the rest. It's funny that bureaucracy comes to the rescue here. It produces standard formulations that are convenient for searching for secret information accidentally leaked onto the Internet.

For example, the Distribution statement stamp, required by the US Department of Defense, means standardized restrictions on the distribution of a document. The letter A denotes public releases in which there is nothing secret; B - intended only for internal use, C - strictly confidential, and so on until F. The letter X stands out separately, which marks particularly valuable information representing a state secret of the highest level. Let those who are supposed to do this on duty search for such documents, and we will limit ourselves to files with the letter C. According to DoDI directive 5230.24, this marking is assigned to documents containing a description of critical technologies that fall under export control. Such carefully protected information can be found on sites in the top-level domain.mil, allocated for the US Army.

"DISTRIBUTION STATEMENT C" inurl:navy.mil

It is very convenient that the .mil domain contains only sites from the US Department of Defense and its contract organizations. Search results with a domain restriction are exceptionally clean, and the titles speak for themselves. Searching for Russian secrets in this way is practically useless: chaos reigns in domains.ru and.rf, and the names of many weapons systems sound like botanical ones (PP “Kiparis”, self-propelled guns “Akatsia”) or even fabulous (TOS “Buratino”).

By carefully studying any document from a site in the .mil domain, you can see other markers to refine your search. For example, a reference to the export restrictions “Sec 2751”, which is also convenient for searching for interesting technical information. From time to time it is removed from official sites where it once appeared, so if you cannot follow an interesting link in the search results, use Google’s cache (cache operator) or the Internet Archive site.

Climbing into the clouds

In addition to accidentally declassified government documents, links to personal files from Dropbox and other data storage services that create “private” links to publicly published data occasionally pop up in Google's cache. It’s even worse with alternative and homemade services. For example, the following query finds data for all Verizon customers who have an FTP server installed and actively using their router.

Allinurl:ftp:// verizon.net

There are now more than forty thousand such smart people, and in the spring of 2015 there were many more of them. Instead of Verizon.net, you can substitute the name of any well-known provider, and the more famous it is, the larger the catch can be. Through the built-in FTP server, you can see files on an external storage device connected to the router. Usually this is a NAS for remote work, a personal cloud, or some kind of peer-to-peer file downloading. All contents of such media are indexed by Google and other search engines, so you can access files stored on external drives via a direct link.

Looking at the configs

Before the widespread migration to the cloud, simple FTP servers ruled as remote storage, which also had a lot of vulnerabilities. Many of them are still relevant today. For example, the popular WS_FTP Professional program stores configuration data, user accounts and passwords in the ws_ftp.ini file. It is easy to find and read, since all records are saved in text format, and passwords are encrypted with the Triple DES algorithm after minimal obfuscation. In most versions, simply discarding the first byte is sufficient.

It is easy to decrypt such passwords using the WS_FTP Password Decryptor utility or a free web service.

When talking about hacking an arbitrary website, they usually mean obtaining a password from logs and backups of configuration files of CMS or e-commerce applications. If you know their typical structure, you can easily indicate the keywords. Lines like those found in ws_ftp.ini are extremely common. For example, in Drupal and PrestaShop there is always a user identifier (UID) and a corresponding password (pwd), and all information is stored in files with the .inc extension. You can search for them as follows:

"pwd=" "UID=" ext:inc

Revealing DBMS passwords

In the configuration files of SQL servers, user names and email addresses are stored in clear text, and their MD5 hashes are written instead of passwords. Strictly speaking, it is impossible to decrypt them, but you can find a match among the known hash-password pairs.

There are still DBMSs that do not even use password hashing. The configuration files of any of them can simply be viewed in the browser.

Intext:DB_PASSWORD filetype:env

With the advent of Windows servers, the place of configuration files was partially taken by the registry. You can search through its branches in exactly the same way, using reg as the file type. For example, like this:

Filetype:reg HKEY_CURRENT_USER "Password"=

Let's not forget the obvious

Sometimes it is possible to get to classified information using data that is accidentally opened and comes to Google’s attention. The ideal option is to find a list of passwords in some common format. Only desperate people can store account information in a text file, Word document or Excel spreadsheet, but there is always enough of them.

Filetype:xls inurl:password

On the one hand, there are a lot of means to prevent such incidents. It is necessary to specify adequate access rights in htaccess, patch the CMS, not use left-handed scripts and close other holes. There is also a file with a list of robots.txt exceptions that prohibits search engines from indexing the files and directories specified in it. On the other hand, if the structure of robots.txt on some server differs from the standard one, then it immediately becomes clear what they are trying to hide on it.

The list of directories and files on any site is preceded by the standard index of. Since for service purposes it must appear in the title, it makes sense to limit its search to the intitle operator. Interesting things are in the /admin/, /personal/, /etc/ and even /secret/ directories.

Stay tuned for updates

Relevance is extremely important here: old vulnerabilities are closed very slowly, but Google and its search results are constantly changing. There is even a difference between a “last second” filter (&tbs=qdr:s at the end of the request URL) and a “real time” filter (&tbs=qdr:1).

The time interval of the date of the last update of the file is also indicated implicitly by Google. Through the graphical web interface, you can select one of the standard periods (hour, day, week, etc.) or set a date range, but this method is not suitable for automation.

From the look of the address bar, you can only guess about a way to limit the output of results using the &tbs=qdr: construction. The letter y after it sets the limit of one year (&tbs=qdr:y), m shows the results for the last month, w - for the week, d - for the past day, h - for the last hour, n - for the minute, and s - for second. The most recent results that have just become known to Google are found using the &tbs=qdr:1 filter.

If you need to write a clever script, it will be useful to know that the date range is set in Google in Julian format using the daterange operator. For example, this is how you can find a list of PDF documents with the word confidential, downloaded from January 1 to July 1, 2015.

Confidential filetype:pdf daterange:2457024-2457205

The range is indicated in Julian date format without taking into account the fractional part. Translating them manually from the Gregorian calendar is inconvenient. It's easier to use a date converter.

Targeting and filtering again

In addition to specifying additional operators in the search query, they can be sent directly in the body of the link. For example, the filetype:pdf specification corresponds to the construction as_filetype=pdf . This makes it convenient to ask any clarifications. Let's say that the output of results only from the Republic of Honduras is specified by adding the construction cr=countryHN to the search URL, and only from the city of Bobruisk - gcs=Bobruisk. You can find a complete list in the developer section.

Google's automation tools are designed to make life easier, but they often add problems. For example, the user’s city is determined by the user’s IP through WHOIS. Based on this information, Google not only balances the load between servers, but also changes the search results. Depending on the region, for the same request, different results will appear on the first page, and some of them may be completely hidden. The two-letter code after the gl=country directive will help you feel like a cosmopolitan and look for information from any country. For example, the code of the Netherlands is NL, but the Vatican and North Korea do not have their own code in Google.

Often, search results end up cluttered even after using several advanced filters. In this case, it is easy to clarify the request by adding several exception words to it (a minus sign is placed in front of each of them). For example, banking, names and tutorial are often used with the word Personal. Therefore, cleaner search results will be shown not by a textbook example of a query, but by a refined one:

Intitle:"Index of /Personal/" -names -tutorial -banking

One last example

A sophisticated hacker is distinguished by the fact that he provides himself with everything he needs on his own. For example, VPN is a convenient thing, but either expensive, or temporary and with restrictions. Signing up for a subscription for yourself is too expensive. It's good that there are group subscriptions, and with the help of Google it's easy to become part of a group. To do this, just find the Cisco VPN configuration file, which has a rather non-standard PCF extension and a recognizable path: Program Files\Cisco Systems\VPN Client\Profiles. One request and you join, for example, the friendly team of the University of Bonn.

Filetype:pcf vpn OR Group

INFO

Passwords are stored encrypted, but Maurice Massard has already written a program to decrypt them and provides it for free through thecampusgeeks.com.

Google runs hundreds of different types of attacks and penetration tests. There are many options, affecting popular programs, major database formats, numerous vulnerabilities of PHP, clouds, and so on. Knowing exactly what you're looking for will make it much easier to find the information you need (especially information you didn't intend to make public). Shodan is not the only one that feeds with interesting ideas, but every database of indexed network resources!

This time I will try to tell you what dorks should not be like. Because you often have to work with clients whose dorks look completely crazy. And after talking a little, it turns out that they also paid for these dorks. It’s annoying, in general) I, out of my stupidity, bought dorks, both for 300 rubles and for 20 rubles. But I have not yet met a competent person who will make dorks that will be good and the search engine will return what I need from them. I'm not trying to offend anyone, and this is just my personal opinion. Firstly, before purchasing, always ask for 10-15 doors to check, just visually evaluate them. I hope after this guide you will be able to identify more or less tailored dorks for your request from those who cannot even be called public. Let's go! It’s easier for me to work with examples, so I’ll try to sketch out a list of “game” traps that sometimes come across, and tell you what you should pay attention to:
Code: mistake.php?gta_5= frame

Let's break it down into parts: mistake.php - here, it is assumed that this word should be present in the link. In fact, it's a little different. For a word to be present in a link, it must be applied to the inurl: or allinurl operator:

Let's say we come across some links with this word. But, it is this part (judging by the door) that should refer to the title of the page. I don't know what kind of coder would create a mistake.php page on their gaming site. Of course, there will be such people. But this will be a very small percentage.

As for me, the page should be more or less with a popular name used by PHP coders. A couple more pages that are not desirable in dorks (often dork sellers use random words): Code: gta5.php - no one will call the page farcry_primal.php farcry_primal.cfm - the .cfm extension is used in ASP.NET, yes, on it they write, but not as often as in PHP. And to run into a page with such a name is a great success kramble.php how_to_work.php catch"in.php - special characters should not be in the name of the page jzooo.php - in general, don't understand what kind of page this is game_of_trone.php - a rare page , + does not refer to games, but most likely to the title of a movie. I hope you understand the approximate logic.

The page should have a logical name, this is the main thing. It is not very important whether the name has something related to the game theme or not. Which pages are mostly used by coders, and generally more popular ones that can be used in dorks:

Index.php
private.php
pm.php
user.php
members.php
area.php
config.php
search.php
redirect.php
r.php (same redirect)
s.php (same search)
mail.php forum.php
post.php account.php
exit.php
query.php
q.php (the same query), etc.

Something like this.

The title of the page in the door (if there is one) should be monosyllabic, convenient for use on the site, and carry some kind of logical subtext. It’s okay that we don’t have names like steam.php or steam_keys.php or roulette.php here, it’s important for us to find more links. And the more often a word from a query is used on websites, the better. We will select the ones we need more or less by topic using the rest of the documentation. We've sorted out the page titles, but that's not the most important thing.

Let's move on to the second part.

Meet this GET request: ?gta_5 - Let me tell you right away, there are no such requests. (I remind you that this is my personal opinion) The GET request, ideally, which we need, should access the database, and in the case of SQL injection, cause an output error from the database. This is what we need. However, finding a request that would be called gta_5 is, again, great luck. And if we find him, we need him to be vulnerable. This again discards most of the links we are interested in. A couple more examples of bad, not good queries:

Groove=
?paypal=
?qiwi_wallet=
?my_money=
?dai_webmoney=
?skdoooze=
?sadlkjadlkjswq=
?213123=
?777=

Why is PayPal a bad request? Because it is assumed that with this request we want to access the database with a selection of PayPal. Nobody stores the Paypal database, except perhaps the company itself. Again, I'm defending it.

Examples of good queries, kind ones that everyone loves to use because they are short, convenient, easy to remember, and have at least some logic:
?id=
?cat=
?cat_id=
?get=
?post=
?frame=
?r=
?redirect= (well, you get the idea)
?banner=
?go=
?leave=
?login=
?pass=
?password=
?username=
?user=
?search=
?s=
?wallet=
?acc=
?balance=
?do=
?page=
?page_id=
?topic=
?forum=
?thread=
?download=
?free=
?message=
Of course, you can continue indefinitely.
But these are universal requests that can perfectly suit mix dorks, gaming dorks, money dorks, and any others. We will come across forums, torrent sites, and everything else. As an example, a couple of queries that may be useful, let’s say for game queries:
?game=
?game_id=
?battle=
?log=
?team=
?weapon=
?inv= (inventory)
?gamedata=
?player=
?players=
?play= (you will come across sites with video clips)
?playtag=
?match=

Approximately the same query logic should ideally be applied to other topics. You need to understand at least a little English and understand what kind of doors you are buying. In general, it’s enough to look at 10-20 doors and it will immediately become clear what kind of mega private you bought, and whether it’s worth contacting this seller in the future. Or in general, make a refund through black if you see that your dorks contain sex.php? or?photo= and you ordered doors for shops. Hands under the train to such figures

And so, finally - the most important part of the dorka (which is sometimes completely absent). If we have just looked at the name of the GET request (not the request itself), now we are moving on to a request that can help us find exactly what we need. From our test dork this part is frame

I won’t say that this is a bad request, but considering that we are looking for gaming sites, the effectiveness of such a request is approximately 15-20%. For mix tracks, or just for the number of links (just to leak something), it will do just fine. The name of the request can include, as they correctly say in many tutorials and manuals on dorks, any words related to our topic. Let's not deviate from gaming queries, so I'll give an example of good, suitable queries for games:
game
gaming
exp
player
level
players
dota
counter-strike
AWP | Aziimov
M19
NAVI
play free
free games
download game
game forum
about game
screenshot game
game guide

It should be clear here what the theme of your roads is. If your purchased dorks have something like the following (and we bought game ones): Code: watch freedom text dsadaswe 213123321 ledy gaga fuck america bla bla girl tits free XXX porn futurama s01e13 Then again, feel free to send a nafik to the seller and throw out your dorks. You won’t see gaming sites :) One more thing, with these queries you can use operators - intitle: , allintitle: , intext: , allintext: Where, after the colon, there will be the game query itself from the list just above (intitle: game, allintext: play free )

It seems that everything I wanted to convey. Basically, I hope the article will be useful at least in some way for beginners (it would be useful for me and would help me save several hundred rubles, and help put unscrupulous wood sellers in their place). Well, if you more or less understand how to make dorks yourself, I will be only glad. Practice, get your eye/hand trained, there’s nothing particularly complicated about dorks. And finally, I don’t know how it works in the dumper, but the a-parser calmly eats and searches for many links with queries in Russian. Why not, I thought. I tested it and was pleased with the effect. You can laugh))

Frame.php?name= games for free
get.php?query= download KS
search.php?ok= game servers

This article will be primarily useful to beginner optimizers, because more advanced ones should already know everything about them. In order to use this article with maximum efficiency, it is advisable to know exactly which words need to be raised to the right positions. If you are still not sure about the list of words, or use the keyword suggestion service, it is a little confusing, but you can figure it out.

Important! Rest assured, Google understands perfectly well that ordinary users will not use them and only promotion specialists will resort to their help. Therefore, Google may slightly distort the information provided

Intitle operator:

Usage: intitle:word
Example: intitle:site promotion
Description: When using this operator, you will receive a list of pages whose title contains the word you are interested in, in our case this is the phrase “site promotion” in its entirety. Please note that there should not be a space after the colon. The page title is important when ranking, so be careful when writing your titles. By using this variable, you can estimate the approximate number of competitors who also want to be in the leading positions for this word.

Inurl operator:

Usage: inurl:phrase
Example: inurl:calculating the cost of search engine optimization
Description: This command shows sites or pages that have the original keyword in their URL. Please note that there should not be a space after the colon.

Inanchor operator:

Usage: inanchor:phrase
Example: inanchor:seo books
Description: Using this operator will help you see pages that are linked to the keyword you are using. This is a very important command, but unfortunately search engines are reluctant to share this information with SEOs for obvious reasons. There are services, Linkscape and Majestic SEO, that will provide you with this information for a fee, but rest assured, the information is worth it.

Also, it is worth remembering that now Google is paying more and more attention to the “trust” of the site and less and less to the link mass. Of course, links are still one of the most important factors, but “trust” is playing an increasingly significant role.

A combination of two variables gives good results, for example intitle: promotion inanchor: site promotion. And what do we see, the search engine will show us the main competitors, whose page title contains the word “promotion” and incoming links with the anchor “site promotion”.

Unfortunately, this combination does not allow you to find out the “trust” of the domain, which, as we have already said, is a very important factor. For example, many older corporate sites don't have as many links as their younger competitors, but they do have a lot of older links, which is what pushes those sites to the top of the search results.

Site operator:

Usage: site:site address
Example: site:www.aweb.com.ua
Description: With this command you can see a list of pages that are indexed by the search engine and that it knows about. It is mainly used to find out about competitors' pages and analyze them.

Cache operator:

Usage: cache:page address
Example: cache:www.aweb.com.ua
Description: This command shows a “snapshot” of the page from the moment the robot last visited the site and in general how it sees the contents of the page. By checking the page cache date, you can determine how often robots visit the site. The more authoritative the site, the more often robots visit it and, accordingly, the less authoritative (according to Google) the site, the less often robots take pictures of the page.

Cache is very important when buying links. The closer the page cache date is to the link purchase date, the faster your link will be indexed by the Google search engine. Sometimes it was possible to find pages with a cache age of 3 months. By purchasing a link on such a site, you will only waste your money, because it is quite possible that the link will never be indexed.

Link operator:

Usage: link:url
Example: link:www.aweb.com.ua
Description: Link operator: Finds and displays pages that link to the specified url. This can be either the main page of the site or the internal one.

Related operator:

Usage: related:url
Example: related:www.aweb.com.ua
Description: Related operator: Returns pages that the search engine thinks are similar to the specified page. For a person, all the pages received may not have anything similar, but for a search engine this is so.

Operator Info:

Usage: info:url
Example: info:www.aweb.com.ua
Description: When using this operator, we will be able to obtain information about the page that is known to the search engine. This could be the author, publication date, and much more. Additionally, on the search page, Google offers several actions that it can do with this page. Or, to put it simply, it will suggest using some of the operators that we described above.

Allintitle operator:

Usage: allintitle:phrase
Example: allintitle:aweb promotion
Description: If we start a search query with this word, we will get a list of pages that have the entire phrase in the title. For example, if we try to search for the word allintitle:aweb promotion, we will get a list of pages whose title mentions both of these words. And they don’t necessarily have to go one after another; they can be located in different places in the header.

Allintext operator:

Usage: allintext:word
Example: allintext:optimization
Description: This operator searches for all pages that have the specified word in their body text. If we try to use allintext: aweb optimization, we will see a list of pages in the text of which these words appear. That is, not the entire phrase “aweb optimization”, but both words “optimization” and “aweb”.