Introduction to Google Hacking

By HackLessons(www.hacklessons.com) / (www.twitter.com/hacklessons)

What is Google Hacking?

“Google Hacking is the process of using advanced operators in the Google Search engine in the effort to return more precise search results.”

In summary, the use of advanced operators when searching Google will allow you to find exactly what you’re looking for more easily.

How will this benefit me?

Fact: Google can be a b$*#& to search, if you don’t know the exact phrase to get the results you’re looking for.

Fact: It’s usually our fault.

Using advanced operators will allow us to find everything we want in a much quicker fashion.

There are some things we just can’t find without these little tricks. Security flaws tend to be a prime example.

Do I need anything special?

There are tools out there to make searching Google even easier, but no tools are required.

However, cheat sheets will be provided and are generally essential to remembering all of these functions.

Building Google Queries

A Google Query is the underlying search equation generated from user input on Google Search.

Your search terms and parameters define your results.

Common Rules

• Google has “wildcards”, however, they are not the same as UNIX and/or programming wildcards. This technique is known as stemming.

• Google stems automatically for you. The word commentate in a sentence may return as: commentate, commentator,

commentating, etc. - > Inaccurate Results.• Queries are NOT case sensitive.

HaCkInG GooGLe will return the exact same search results as HACKING GOOGLE or hacking google.

• Google likes to ignore the popular kids. The words: who, what, where, when, a, an, or the ... are often removed from the

search equation, but not always. Results may vary.• Google ignores punctuation.

There are a few exceptions to this, such as: C++, dvd $400, quick_sort, etc

Operator SyntaxOperator Description Usage

+ / - Force a search for a commonly used word or remove a word showing up.

+word / -word

“ ” Specific word / string order. “Life is a foreign language; all men mispronounce it.”

. / * . is for single character wildcard.* represents any word.

w . rd / life is a *

site: Search only a specific site. site:edufire.comfiletype: Search only the text of a specific file

type.filetype:pdf

link: Search only within the text of hyperlinks.

link:edufire

cache: Displays the cached version of a web page.

cache:edufire.com

allintitle: Search page titles for all search terms.

allintitle:edufire tech

intitle: Search page titles for specific search term.

intitle:edufire tech

inurl: Search only with the text of a URL. inurl:edufire

Find what you need, when you need it.

(e)Books -inurl:htm -inurl:html intitle:"index of" +("/ebooks"|"/book") +(chm|pdf|zip) +“Book Name Goes Here"

Images -inurl:(htm|html|php) intitle:"index of" +"last modified" +"parent directory" +description +size +(jpg|jpeg|png|bmp|gif)

Music -inurl:(htm|html|php) intitle:"index of" +"last modified" +"parent directory" +description +size +(wma|mp3) “Band/Song Name Goes Here"

Phonebook/ Address phonebook: John Doe / phonebook: John Doe Washington DC / #555-555-5555

Video -inurl:(htm|html|php) intitle:"index of" +"last modified" +"parent directory" +description +size +(wmv|avi|mp4|mpg|mkv|mov|flv)

Weather weather: DC / weather: Washington DC / weather: 20073

Unit Conversion 5 USD in Yen / tablespoons in a cup / 1 gigabyte in kilobytes

Local Time time in Hong Kong / time in Australia / time in Brazil

Flight Status Continental Airlines 2718 / United Airlines 7607 / Delta Air Lines 5466

Live Webcam inurl:view/view.shtml / intitle:liveapplet / inurl:ViewerFrame?Mode=

Google Language as a Proxy Server

Google Language Tools has been a great tool to translate text/websites from one language to another. However, it can also be used as a Proxy Server!

Translate a Web Page

Enter in any web address that you would like to go to with Google as your Proxy.

Google will not translate any *English* text into English.

Google’s Proxy is a Transparent Proxy, meaning it does not conceal your IP address.

Google “Proxy” is out of Cookies!

Google’s Language service does not store Cookies so you are not able to use web sites that require them.

Make Sure It’s All Working

In order to double check to make sure you’re actually using Google as a proxy, check that a web address such as the above is in your address bar.

You do not want to see http://facebook.com/ or any other site. You want to see translate.google.com or you’re doing it wrong. (No pun intended in that phrase ;) )

Exercises

1. Find tech classes on EduFirea) Remove tech support pages from results

2. Find out who links to EduFirea) Remove EduFire’s website from results

3. Find out the weather for your City and Statea) via Zip Code

4. Find out if your phone number is listed5. Find a song that is very common6. Find live webcams.

Exercise Answers

1. site:edufire.com techa) site:edufire.com tech -support

2. link:edufire.coma) link:edufire.com –site:edufire.com

3. weather:Washington DCa) weather:20073

4. #555-555-55555. -inurl:(htm|html|php) intitle:"index of" +"last

modified" +"parent directory" +description +size +(wma|mp3) “Amazing Grace“

6. inurl:view/view.shtml

Summary

Google is more powerful than most people realize.

You just have to learn how to utilize it to suit your needs.

There is a learning curve, but it’s definitely worth it.