New Blog Section: Blue Team Googledorks

Introduction to Googledorking

Googledorking is the act of using Google advanced search operators in order to more finely tailor your searches. It’s good for general-purpose searches but where it really shines is when you start to use it in security operations in addition to other Cyber Threat Intelligence (CTI) activities and collection.

Googledorking is a phenomenal way to do reconnaissance for red teams (penetration testing or other offensive cybersecurity roles). It’s one of the first things that you go to when you’re researching a target. There is even a Google Hacking Database to help you find specific targets like specific content management systems or even a particular model of embedded devices that end up online.

I built a class on network reconnaissance in 2020 for EC-Council’s Code Red learning platform and one of the skills I put into the class was Googledorking and a step-by-step process for how to build your own searches by looking at a web page and its HTML source.

Blue Team Googledorking

But Blue Team (SOC, CSIRT, any defensive cybersecurity team) Googledorking (and other OSINT techniques) is not used much or even talked about. Which is sad, because I’ve used it heavily over the years. I want to fix that by introducing the topic here and then over time discussing some of the techniques that I’ve used over the years.

Some of the ways that you can use Blue Team Googledorks include the following:

• Monitoring your own websites for data leaks.
• Following hacktivist campaigns on Twitter.
• Finding credential dumps on Pastebin.
• Researching attack tools on Github.
• Looking for new attack tool capabilities and futures on YouTube.
• Identifying criminal websites, tools sites, and forums.
• A ton of other things that we’ll talk about.

Build Your Own

The short version of how to build searches is that I usually prototype them manually on the Google search page. It’s a bit of trial and error. If you get too many irrelevant results, then add another term as a filter. As I go through some of my searches in later posts, they will start to make more sense.

• Mandatory words and phrases using quotes: “must love hacking” “linux”
• Boolean Or using the pipe (“|”) character and grouped with parenthesis: (this|”or that”)
• Specific websites or domains: site:www.foo.com
• URL paths: inurl:path/to/application
• Words in the title: intitle:WAF
• Exclude these words or patterns with a minus sign: -site:.gov.sg -“kali linux”

Automating Googledorks for Blue Teams

While Googledorks themselves are helpful to use interactively, the real value happens when you can use an automated system.

For example, one of the ways that I used Googledorks with automation is to generate a feed of news reports on successful attacks that I would then triage to see if they were customers. If they were customers, then we would proactively spin up an incident response to help them wherever possible. If the victim wasn’t a customer, we would archive the results for future research.

Google Alerts lets you take any search string and automate it. You can then get results delivered either via email or as RSS. I take the RSS for numerous searches and import them into a good reader. For many years, I would get up in the morning and review my Googledork hits in my RSS reader and send the interesting ones off for action for the rest of the day/week.

Google Custom Search Engine allows you to perform searches programatically in several languages. You’re limited in the number of quantities of results that you get. Inside my CSIRT, we set up Scumblr (the project has been abandoned, I’m looking for an alternative to go from searches into a ticketing system) to use a Custom Search Engine to collect intelligence. The key here is that a ticketing system allows you to load-balance across a team.

Some programming languages have libraries like Python’s Google Search that just makes a web search and scrapes the HTML. If you make too many requests, Google rate-limits you and your tool doesn’t work for awhile.

There is an entire greymarket sub-industry built around providing an extended set of Google search results. They are running bots that attempt to evade the rate limitations and other protections that Google uses, so sometimes they lose the ability to pull results. But they do provide API access. However, because they’re greymarket services, I won’t link to them here. You’ll have to use Google to find them, the key phrase is “SERP API”.

Not just Google

You can take a lot of Googledorks and try them on Bing, Yandex, and maybe Baidu. These search engines sometimes have much more lax permissions on the advanced operators and the rate that you can make requests.

So Where from Here?

I’ll keep adding blog posts here with some of the Googledorks that I use and have used in the past. In the interests of shameless self-promotion, feel free to subscribe here via email, here via feed, on my company site on LinkedIn, or on my personal profile on LinkedIn. And have fun with it.

Published on March 23, 2021.
Last Updated on 6 months ago.