‫So in the previous video, we talked about crawlers, but don't forget, search engines are the best
‫crawlers.
‫They work almost exactly as we want them to, and they have a huge amount of data about the publicly
‫exposed Web applications.
‫See, when a search engine bot crawls a Web application, it indexes the pages according to some rules
‫that are associated to the page and its content.
‫They can index almost anything within a website, including sensitive information.
‫So they have a complex working style and they always update the way they crawl.
‫But at the end of the day, they provide us with so much good information from.
‫Everything from error messages to vulnerable files and servers.
‫OK, so now go to Caleigh and open up your browser.
‫And for the majority of our generation, Google is one of the first search engines that comes to mind.
‫But it is by no means alone, there are several other search engines, such as Being and Yandex and
‫Yahoo!
‫And of course anybody could go on, but we are going to conduct the Google queries to get more.
‫So for the average person, Google is just a search engine used to find text, images, videos, it's
‫even a spellchecker for some.
‫However, for Penn testers, Google is a very useful hacking tool.
‫So go ahead, type Google dot com.
‫And you can run Google search queries from this interface.
‫But besides his simple interface, Google has an advanced search functionality.
‫So go to settings and click on Advanced Search.
‫And you can use this page for more detailed queries, also, Google search engine has its own built
‫in query language, and I'll give you a list of these search operators.
‫So you can also use these search operators to get detailed results.
‫So in order to benefit from Google more using these operators can come in quite handily.
‫So let's run some searches with some of these advanced operators.
‫OK?
‫So let's find New York Times subdomains type site, Colen NY Times dot com dash site, Colen W w w dot.
‫NY Times dot com.
‫So the site command will bring the results that contain only NY, my Zackham.
‫And the dash before the second site will exclude the results that contain NY Times.
‫Com.
‫OK, so look at the number of results.
‫Now, if you add.
‫And in Colin Log-in.
‫It will bring us the results that contain login pages.
‫But be careful, Google doesn't necessarily want us using the advanced search for our purposes.
‫Google will start blocking your connection if you connect from a single static IP, OK, so it will
‫ask for captcha challenges to prevent automated queries.
‫So I'm going to fill in this capture box.
‫It's always a favorite thing to do.
‫Now, look at the number of results, it decreases a lot.
‫Now add or in Earl Colon sign up to bring sign up pages.
‫So this time the number of results are increased.
‫So you can also look for a vulnerable version of any of the Web technologies.
‫So type in Earl Colon, BHP, my admin slash index dot p and in title colon P, my admin to dot one
‫one.
‫And look at the results, it's going to bring up all of the pages that are version 2.0 on one of my
‫admin, so also we can perform the same search for fescue lite manager, just type in title Colon Eskew
‫like manager and Earl Colon slash Eskew light slash in text colon.
‫Welcome to.
‫And look at that, here are the Eskew lite manager pages.
‫Now, there are a few pages listed.
‫But Google does not only index the HTTP based servers, it also indexes open FTP servers.
‫So if you type in title Colen index of an URL, Colan FTP open FTP servers will be listed.
‫Now, I know you might say this is not enough where you can go with a prepared queries that are performed
‫by the hacking community.
‫Why didn't I say that before?
‫Because these queries are stored in the Google hacking database that you didn't know it existed.
‫Now you do.
‫So open this page.
‫GHB is also served by offensive security.
‫So here, every query is called Google Dork.
‫So you can apply any door to your target application and server, just click on any dork.
‫And from here, just click to see the Google search results and now you can analyze the results.
‫So imagine that a Drupal vulnerability is announced, you can create a Google query to identify the
‫servers or applications that have this vulnerability, or you can check Google hacking database to find
‫it and use it.
‫So now the world is up to your imagination and you.