paulsunny007 / infosec-dorks

A Personal collection of Infosec Dorks

Surface Discovery

Config files

• site:[TARGET] ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:env | ext:ini

Database files

• site:[TARGET] ext:sql | ext:db | ext:dbf | ext:mdb | ext:sql.gz | ext:sql.gz | ext:db.gz | ext:db.gz

Backup files

• site:[TARGET] ext:bkf | ext:bkp | ext:bak | ext:old | ext:backup

.git folder

• inurl:"/.git" [TARGET] -site:github.com

Exposed documents

• site:[TARGET] ext:doc | ext:docx | ext:odt | ext:pdf | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv

SQL errors

• site:[TARGET] AND (intext:"sql syntax near" | intext:"syntax error has occurred" | intext:"incorrect syntax near" | intext:"unexpected end of SQL command" | intext:"Warning: mysql_connect()" | intext:"Warning: mysql_query()" | intext:"Warning: pg_connect()")

PHP errors

• site:[TARGET] AND ("PHP Parse error" | "PHP Warning" | "PHP Error")
• site:[TARGET] "Index of" inurl:phpmyadmin

Login pages

• site:[TARGET] AND (inurl:signup | inurl:login | inurl:register | intitle:Signup)

Open redirects

• site:[TARGET] AND (inurl:redir | inurl:url | inurl:redirect | inurl:return | inurl:location | inurl:next | inurl:dest | inurl:src=http | inurl:r=http)

Apache Struts RCE

• site:[TARGET] AND (ext:action | ext:struts | ext:do)

Wordpress files

• site:[TARGET] AND (inurl:wp-content | inurl:wp-includes)
• site:[TARGET] inurl:wp-config.php intext:DB_PASSWORD
• site:[TARGET] intitle:"Index of" wp-admin

Other files

• site:[TARGET] AND (intitle:index.of | ext:log | ext:php intitle:phpinfo "published by the PHP Group" | inurl:shell | inurl:backdoor | inurl:wso | inurl:cmd | shadow | passwd | boot.ini | inurl:backdoor | inurl:readme | inurl:license | inurl:install | inurl:setup | inurl:config | inurl:"/phpinfo.php" | inurl:".htaccess" | ext:swf)

• site:[TARGET] AND (ext:env | ext:log | ext:sql | ext:yml | ext:pem | ext:ini | ext:logs | ext:ibd | ext:txt | ext:php.txt | ext:old | ext:key | ext:frm | ext:bak | ext:zip | ext:swp | ext:conf | ext:db | ext:config | ext:ovpn | ext:svn | ext:git | ext:cfg | ext:exs | ext:dbf | ext:mdb | ext:pem | ext:pub | ext:yaml | ext:zip | ext:asc | ext:xls | ext:xlsx")

Various Single Dorks

• site:[TARGET] inurl:_cpanel/forgotpwd
• site:[TARGET] inurl:/proc/self/cwd
• site:[TARGET] inurl:/etc/
• site:[TARGET] filename:constants
• site:[TARGET] filename:settings
• site:[TARGET] filename:database
• site:[TARGET] filename:config
• site:[TARGET] filename:environment
• site:[TARGET] filename:spec
• site:[TARGET] filename:zhrc
• site:[TARGET] filename:bash
• site:[TARGET] filename:npmrc
• site:[TARGET] filename:dockercfg
• site:[TARGET] filename:pass
• site:[TARGET] filename:global
• site:[TARGET] filename:credentials
• site:[TARGET] filename:connections
• site:[TARGET] filename:s3cfg
• site:[TARGET] filename:wp-config
• site:[TARGET] filename:htpasswd
• site:[TARGET] filename:git-credentials
• site:[TARGET] filename:id_dsa
• site:[TARGET] filename:id_rsa
• site:[TARGET] extension:env
• site:[TARGET] extension:cfg
• site:[TARGET] extension:ini
• site:[TARGET] language:yaml -filename:travis
• site:[TARGET] extension:properties
• site:[TARGET] extension:bat
• site:[TARGET] extension:sh
• site:[TARGET] extension:zsh
• site:[TARGET] extension:pem
• site:[TARGET] extension:ppk
• site:[TARGET] extension:sql
• site:[TARGET] extension:json
• site:[TARGET] extension:xml
• site:[TARGET] filename:bash_history
• site:[TARGET] filename:bash_profile
• site:[TARGET] filename:bashrc
• site:[TARGET] filename:cshrc
• site:[TARGET] filename:history
• site:[TARGET] filename:netrc
• site:[TARGET] filename:pgpass
• site:[TARGET] filename:tugboat
• site:[TARGET] filename:dhcpd.conf
• site:[TARGET] filename:express.conf
• site:[TARGET] filename:filezilla.xml
• site:[TARGET] filename:idea14.key
• site:[TARGET] filename:makefile
• site:[TARGET] filename:gitconfig
• site:[TARGET] filename:prod.exs
• site:[TARGET] filename:prod.secret.exs
• site:[TARGET] filename:proftpdpasswd
• site:[TARGET] filename:recentservers.xml
• site:[TARGET] filename:robomongo.json
• site:[TARGET] filename:server.cfg
• site:[TARGET] filename:shadow
• site:[TARGET] filename:sshd_config
• site:[TARGET] filename:known_hosts
• site:[TARGET] filename:wp-config.php
• site:[TARGET] filename:.env
• site:[TARGET] filename:hub
• site:[TARGET] filename:.netrc
• site:[TARGET] filename:_netrc
• site:[TARGET] filename:ventrilo_srv.ini
• site:[TARGET] filename:dbeaver-data-sources.xml
• site:[TARGET] filename:sftp-config.json
• site:[TARGET] filename:.esmtprc password
• site:[TARGET] filename:.remote-sync.json
• site:[TARGET] filename:WebServers.xml
• site:[TARGET] staging
• site:[TARGET] stg
• site:[TARGET] prod
• site:[TARGET] preprod
• site:[TARGET] swagger
• site:[TARGET] internal
• site:[TARGET] dotfiles
• site:[TARGET] dot-files
• site:[TARGET] mydotfiles
• site:[TARGET] config
• site:[TARGET] dbpasswd
• site:[TARGET] db_password
• site:[TARGET] db_username
• site:[TARGET] dbuser
• site:[TARGET] testuser
• site:[TARGET] dbpassword
• site:[TARGET] keyPassword
• site:[TARGET] storePassword
• site:[TARGET] passwords
• site:[TARGET] password
• site:[TARGET] secret.password
• site:[TARGET] database_password
• site:[TARGET] sql_password
• site:[TARGET] passwd
• site:[TARGET] pass
• site:[TARGET] pwd
• site:[TARGET] pwds
• site:[TARGET] root_password
• site:[TARGET] credentials
• site:[TARGET] security_credentials
• site:[TARGET] connectionstring
• site:[TARGET] private -language:java
• site:[TARGET] private_key
• site:[TARGET] master_key
• site:[TARGET] token
• site:[TARGET] access_token
• site:[TARGET] auth_token
• site:[TARGET] oauth_token
• site:[TARGET] authorizationToken
• site:[TARGET] secret
• site:[TARGET] secrets
• site:[TARGET] secret_key
• site:[TARGET] secret_token
• site:[TARGET] api_secret
• site:[TARGET] app_secret
• site:[TARGET] appsecret
• site:[TARGET] client_secret
• site:[TARGET] key
• site:[TARGET] send_keys
• site:[TARGET] send.keys
• site:[TARGET] sendkeys
• site:[TARGET] apikey
• site:[TARGET] api_key
• site:[TARGET] app_key
• site:[TARGET] application_key
• site:[TARGET] appkey
• site:[TARGET] appkeysecret
• site:[TARGET] access_key
• site:[TARGET] apiSecret
• site:[TARGET] x-api-key
• site:[TARGET] apidocs
• site:[TARGET] secret_access_key
• site:[TARGET] encryption_key
• site:[TARGET] consumer_key
• site:[TARGET] auth
• site:[TARGET] secure
• site:[TARGET] login
• site:[TARGET] conn.login
• site:[TARGET] sshpass
• site:[TARGET] ssh2_auth_password
• site:[TARGET] irc_pass
• site:[TARGET] fb_secret
• site:[TARGET] sf_username
• site:[TARGET] node_env
• site:[TARGET] aws_key
• site:[TARGET] aws_token
• site:[TARGET] aws_secret
• site:[TARGET] aws_access
• site:[TARGET] AWSSecretKey
• site:[TARGET] github_key
• site:[TARGET] github_token
• site:[TARGET] gh_token
• site:[TARGET] slack_api
• site:[TARGET] slack_token
• site:[TARGET] bucket_password
• site:[TARGET] redis_password
• site:[TARGET] ldap_username
• site:[TARGET] ldap_password
• site:[TARGET] gmail_username
• site:[TARGET] gmail_password
• site:[TARGET] codecov_token
• site:[TARGET] fabricApiSecret
• site:[TARGET] mailgun
• site:[TARGET] mailchimp
• site:[TARGET] appspot
• site:[TARGET] firebase
• site:[TARGET] gitlab
• site:[TARGET] stripe
• site:[TARGET] herokuapp
• site:[TARGET] cloudfront
• site:[TARGET] amazonaws
• site:[TARGET] npmrc _auth
• site:[TARGET] pem private
• site:[TARGET] aws_access_key_id
• site:[TARGET] bashrc password
• site:[TARGET] xoxp OR xoxb OR xoxa
• site:[TARGET] FTP
• site:[TARGET] s3.yml
• site:[TARGET] .exs
• site:[TARGET] beanstalkd.yml
• site:[TARGET] deploy.rake
• site:[TARGET] mysql
• site:[TARGET] .bash_history
• site:[TARGET] .sls
• site:[TARGET] composer.jsonfilename:.npmrc _auth
• site:[TARGET] filename:.dockercfg auth
• site:[TARGET] extension:pem private
• site:[TARGET] extension:ppk private
• site:[TARGET] filename:id_rsa or filename:id_dsa
• site:[TARGET] extension:sql mysql dump
• site:[TARGET] extension:sql mysql dump password
• site:[TARGET] filename:credentials aws_access_key_id
• site:[TARGET] filename:.s3cfg
• site:[TARGET] filename:.htpasswd
• site:[TARGET] filename:.env DB_USERNAME NOT homestead
• site:[TARGET] filename:.env MAIL_HOST=smtp.gmail.com
• site:[TARGET] filename:.git-credentials
• site:[TARGET] PT_TOKEN language:bash
• site:[TARGET] filename:.bashrc password
• site:[TARGET] filename:.bashrc mailchimp
• site:[TARGET] filename:.bash_profile aws
• site:[TARGET] rds.amazonaws.com password
• site:[TARGET] extension:json api.forecast.io
• site:[TARGET] extension:json mongolab.com
• site:[TARGET] extension:yaml mongolab.com
• site:[TARGET] jsforce extension:js conn.login
• site:[TARGET] SF_USERNAME salesforce
• site:[TARGET] filename:.tugboat NOT _tugboat
• site:[TARGET] HEROKU_API_KEY language:shell
• site:[TARGET] HEROKU_API_KEY language:json
• site:[TARGET] filename:.netrc password
• site:[TARGET] filename:_netrc password
• site:[TARGET] filename:hub oauth_token
• site:[TARGET] filename:filezilla.xml Pass
• site:[TARGET] filename:recentservers.xml Pass
• site:[TARGET] filename:config.json auths
• site:[TARGET] filename:config irc_pass
• site:[TARGET] filename:connections.xml
• site:[TARGET] filename:express.conf path:.openshift
• site:[TARGET] filename:.pgpass
• site:[TARGET] [WFClient] Password= extension:ica
• site:[TARGET] filename:server.cfg rcon password
• site:[TARGET] JEKYLL_GITHUB_TOKEN
• site:[TARGET] filename:.bash_history
• site:[TARGET] filename:.cshrc
• site:[TARGET] filename:.history
• site:[TARGET] filename:.sh_history
• site:[TARGET] filename:prod.exs NOT prod.secret.exs
• site:[TARGET] filename:configuration.php JConfig password
• site:[TARGET] filename:config.php dbpasswd
• site:[TARGET] filename:config.php pass
• site:[TARGET] path:sites databases password
• site:[TARGET] shodan_api_key language:python
• site:[TARGET] shodan_api_key language:shell
• site:[TARGET] shodan_api_key language:json
• site:[TARGET] shodan_api_key language:ruby
• site:[TARGET] filename:shadow path:etc
• site:[TARGET] filename:passwd path:etc
• site:[TARGET] extension:avastlic "support.avast.com"
• site:[TARGET] extension:json googleusercontent client_secret
• site:[TARGET] HOMEBREW_GITHUB_API_TOKEN language:shell
• site:[TARGET] xoxp OR xoxb
• site:[TARGET] .mlab.com password
• site:[TARGET] filename:logins.json
• site:[TARGET] filename:CCCam.cfg
• site:[TARGET] msg nickserv identify filename:config
• site:[TARGET] filename:settings.py SECRET_KEY
• site:[TARGET] filename:secrets.yml password
• site:[TARGET] filename:master.key path:config
• site:[TARGET] filename:deployment-config.json
• site:[TARGET] filename:.ftpconfig
• site:[TARGET] filename:sftp.json path:.vscode
• site:[TARGET] filename:jupyter_notebook_config.json
• site:[TARGET] "api_hash" "api_id"
• site:[TARGET] "https://hooks.slack.com/services/"
• site:[TARGET] filename:github-recovery-codes.txt
• site:[TARGET] filename:gitlab-recovery-codes.txt
• site:[TARGET] filename:discord_backup_codes.txt
• site:[TARGET] extension:yaml cloud.redislabs.com
• site:[TARGET] extension:json cloud.redislabs.com
• site:[TARGET] stage
• site:[TARGET] _key
• site:[TARGET] _token
• site:[TARGET] _secret
• site:[TARGET] TODO
• site:[TARGET] signup
• site:[TARGET] register
• site:[TARGET] admin
• site:[TARGET] administrator
• site:[TARGET] testing
• site:[TARGET] extension:exs
• site:[TARGET] extension:sls
• site:[TARGET] filename:beanstalkd.yml
• site:[TARGET] filename:deploy.rake
• site:[TARGET] filename:composer.json
• site:[TARGET] filename:composer.lock
• site:[TARGET] ftp
• site:[TARGET] ssh

Services

Credentials in Trello

• inurl:trello.com AND intext:[TARGET]

If there are numerous results, narrow it further down with:

• inurl:trello.com AND intext:username AND intext:[TARGET]
• inurl:trello.com AND intext:password AND intext:[TARGET]
• inurl:trello.com AND intext:apikey AND intext:[TARGET]

Zoom

• inurl:http://zoom.us/j [TARGET]
• inurl:http://zoom.us/j intext:password [TARGET]
• inurl:http://zoom.us/j intext:id# [TARGET]

Ciphermail Login

• site:*.target.com intext:"CipherMail Email Encryption Gateway login"

Various Services

• site:sharepoint.com [TARGET]
• site:box.com/s [TARGET]
• site:dropbox.com/s [TARGET]
• site:onedrive.live.com [TARGET]
• site:docs.google.com inurl:"/d/" [TARGET]
• site:[TARGET] inurl:Dashboard.jspa intext:"Atlassian Jira Project Management Software"

Linkedin employees

• site:linkedin.com employees [TARGET]

Cloud Services & Online Dev Tools

AWS S3 Buckets

• intext:[TARGET] AND (site:"s3-external-1.amazonaws.com" | site:"s3.amazonaws.com")

Make sure to check the various regions:

• intext:[TARGET] AND (site:s3.af-south-1.amazonaws.com | site:s3.ap-east-1.amazonaws.com | site:s3.ap-northeast-1.amazonaws.com | site:s3.ap-northeast-2.amazonaws.com | site:s3.ap-northeast-3.amazonaws.com | site:s3.ap-south-1.amazonaws.com | site:s3.ap-south-2.amazonaws.com | site:s3.ap-southeast-1.amazonaws.com | site:s3.ap-southeast-2.amazonaws.com | site:s3.ap-southeast-3.amazonaws.com | site:s3.ap-southeast-4.amazonaws.com | site:s3.ca-central-1.amazonaws.com | site:s3.eu-central-1.amazonaws.com | site:s3.eu-central-2.amazonaws.com | site:s3.eu-north-1.amazonaws.com | site:s3.eu-south-1.amazonaws.com | site:s3.eu-south-2.amazonaws.com | site:s3.eu-west-1.amazonaws.com | site:s3.eu-west-2.amazonaws.com | site:s3.eu-west-3.amazonaws.com | site:s3.me-central-1.amazonaws.com | site:s3.me-south-1.amazonaws.com | site:s3.sa-east-1.amazonaws.com | site:s3.us-east-1.amazonaws.com | site:s3.us-east-2.amazonaws.com | site:s3.us-gov-east-1.amazonaws.com | site:s3.us-gov-west-1.amazonaws.com | site:s3.us-west-1.amazonaws.com | site:s3.us-west-2.amazonaws.com)
• intext:[TARGET] AND (site:s3.dualstack.af-south-1.amazonaws.com | site:s3.dualstack.ap-east-1.amazonaws.com | site:s3.dualstack.ap-northeast-1.amazonaws.com | site:s3.dualstack.ap-northeast-2.amazonaws.com | site:s3.dualstack.ap-northeast-3.amazonaws.com | site:s3.dualstack.ap-south-1.amazonaws.com | site:s3.dualstack.ap-south-2.amazonaws.com | site:s3.dualstack.ap-southeast-1.amazonaws.com | site:s3.dualstack.ap-southeast-2.amazonaws.com | site:s3.dualstack.ap-southeast-3.amazonaws.com | site:s3.dualstack.ap-southeast-4.amazonaws.com | site:s3.dualstack.ca-central-1.amazonaws.com | site:s3.dualstack.eu-central-1.amazonaws.com | site:s3.dualstack.eu-central-2.amazonaws.com | site:s3.dualstack.eu-north-1.amazonaws.com | site:s3.dualstack.eu-south-1.amazonaws.com | site:s3.dualstack.eu-south-2.amazonaws.com | site:s3.dualstack.eu-west-1.amazonaws.com | site:s3.dualstack.eu-west-2.amazonaws.com | site:s3.dualstack.eu-west-3.amazonaws.com | site:s3.dualstack.me-central-1.amazonaws.com | site:s3.dualstack.me-south-1.amazonaws.com | site:s3.dualstack.sa-east-1.amazonaws.com | site:s3.dualstack.us-east-1.amazonaws.com | site:s3.dualstack.us-east-2.amazonaws.com | site:s3.dualstack.us-gov-east-1.amazonaws.com | site:s3.dualstack.us-gov-west-1.amazonaws.com | site:s3.dualstack.us-west-1.amazonaws.com | site:s3.dualstack.us-west-2.amazonaws.com)

Azure

• site:"blob.core.windows.net" AND intext:[TARGET]

Google Cloud

• site:"storage.googleapis.com" AND intext:[TARGET]

Digitalocean Spaces

• site:"digitaloceanspaces.com" [TARGET]

Git Providers

• site:github.com | site:gitlab.com | site:bitbucket.org [TARGET]

Secrets in Microsoft Devops

• site:"dev.azure.com" AND intext:secret
• site:"dev.azure.com" AND intext:password
• site:"dev.azure.com" AND intext:apikey

GitHub, GitLab, BB online dev enviroments?

Various Services

• site:stackoverflow.com AND intext:"[TARGET]"
• site:jfrog.io AND intext:"[TARGET]"
• [TARGET]
• intitle:traefik inurl:8080/dashboard [TARGET]
• intitle:"Dashboard [Jenkins]" [TARGET]
• (site:bitpaste.app | site:codebeautify.org | site:codepad.co | site:codepad.co |site:ideone.com | site:codepad.org | site:codepen.io | site:codeshare.io | site:coggle.it | site:controlc.com | site:dotnetfiddle.net | site:dpaste.com | site:dpaste.org | site:gitter.im | site:hastebin.com | site:heypasteit.com | site:ide.geeksforgeeks.org | site:ideone.com | site:jsdelivr.com | site:jsdelivr.net | site:jsfiddle.net) AND "[TARGET]"
• (site:justpaste.it | site:libraries.io | site:npmjs.com | site:npm.runit.com | site:npm.runkit.com | site:papaly.com | site:paste2.org | site:pastebin.com | site:paste.debian.net | site:pastehtml.com | site:paste.org | site:phpfiddle.org | site:prezi.com | site:productforums.google.com | site:repl.it | site:replt.it | site:scribd.com | site:sharecode.io | site:snipplr.com | site:trello.com | site:ycombinator.com) AND "[TARGET]"