Severe Vulnerability in Internet Information Services (IIS)

 Many security experts and security companies have claimed that this vulnerability is one of the most critical security flaws that have been detected and fixed by Microsoft this month.

HTTP Protocol Stack RCE Vulnerability

This critical flaw (CVE-2021-31166) is akin to corruption of information in the memory of the HTTP protocol stack (HTTP.sys) that is already included in all the recent versions of Windows.

    CVE ID: CVE-2021-31166
    Assigning CNA: Microsoft
    Released: May 11, 2021
    CVSS: 3.0 (9.8 out of 10)

In general, this HTTP Protocol Stack is used by the Windows IIS (Internet Information Services) server, so, the security expert, Axel Souchet, who used to work for Microsoft has explained that if this server is active, then an attacker can easily send it a specially crafted packet to execute malicious code at the OS kernel level.

This security flaw is quite similar to another Microsoft vulnerability that was detected in the HTTP network stack. It was tracked as CVE-2015-1635 and detected or reported by the security experts in 2015.

Moreover, it becomes worse when Microsoft warned that this RCE vulnerability has the potential of a worm, as it can be used by the threat actors to create malware that spreads itself from server to server.
PoC for CVE-2021-31166 triggers Blue Screen of Death (BSOD)

To show the flaw in action the former Microsoft security researcher, Axel Suchet published a PoC exploit for CVE-2021-31166 (“HTTP Protocol Stack Remote Code Execution Vulnerability”).

From the above image, you can see the flaw in action, and how this critical flaw triggers the Blue Screen of Death (BSOD). Here, Axel explains that where the function has a local LIST_ENTRY, this bug happens itself in the “http!UlpParseContentCoding” and then it affix the item to it.

And here the interesting thing is that it does not NULL out the local list (LIST_ENTRY) after it moves it into the Request structure when it is done.

It means that an attacker can easily leave all the entries of the local list in a hanging state in the Request object by triggering the code path that unlocks all the entries of the local list.
Possible targets are safe from attacks

Axel Suchet claimed since the capabilities of the HTTP Protocol Stack RCE flaw are artificially limited, so, it is likely that most of the potential targets are safe from such attacks.

While this security flaw only affects the newest OS versions like Windows 10 2004 and 20H2, as well as Windows Server 2004 and 20H2, and all these versions are not yet very widespread.

Moreover, the vulnerability CVE-2021-31166 does not allow the formulation of a full-fledged worm, and it only leads to a “crash” (DoS) of unpatched Windows versions that are running the IIS server.

But, apart from all these things, the security team at Microsoft has strongly recommended all its users to install all the security updates published on an immediate basis. 

Read More

2020 Hacks & Data Breaches

 JANUARY:

• Travelex: Travelex services were pulled offline following a malware infection. The company itself and businesses using the platform to provide currency exchange services were all affected.
• IRS tax refunds: A US resident was jailed for using information leaked through data breaches to file fraudulent tax returns worth $12 million.
• Manor Independent School District: The Texas school district lost $2.3 million during a phishing scam.
• Wawa: 30 million records containing customers' details were made available for sale online.
• Microsoft: The Redmond giant disclosed that five servers used to store anonymized user analytics were exposed and open on the Internet without adequate protection.
• Medical marijuana: A database backing point-of-sale systems used in medical and recreational marijuana dispensaries was compromised, impacting an estimated 30,000 US users.



FEBRUARY:
• Estée Lauder: 440 million internal records were reportedly exposed due to middleware security failures.
• Denmark's government tax portal: The taxpayer-identification numbers of 1.26 million Danish citizens were accidentally exposed.
• DOD DISA: The Defense Information Systems Agency (DISA), which handles IT for the White House, admitted to a data breach potentially compromising employee records.
• UK Financial Conduct Authority (FCA): The FCA released sensitive information belonging to roughly 1,600 consumers by accident as part of an FOIA request.
• Clearview: Clearview AI's entire client list was stolen due to a software vulnerability.
• General Electric: GE warned workers that an unauthorized individual was able to access information belonging to them due to security failures with supplier Canon Business Process Service.


MARCH:
• T-Mobile: A hacker gained access to employee email accounts, compromising data belonging to customers and employees.
• Marriott: The hotel chain suffered a cyberattack in which email accounts were infiltrated. 5.2 million hotel guests were impacted.
• Whisper: The anonymous secret-sharing app exposed millions of users' private profiles and datasets online.
• UK Home Office: GDPR was breached 100 times in the handling of the Home Office's EU Settlement Scheme.
• SIM-swap hacking rings: Europol made arrests across Europe, taking out SIM-swap hackers responsible for the theft of over €3 million.
• Virgin Media: The company exposed the data of 900,000 users through an open marketing database.
• Whisper: Millions of users' private profiles and datasets were left, exposed and online, for the world to see.
• MCA Wizard: 425GB in sensitive documents belonging to financial companies was publicly accessible through a database linked to the MCA Wizard app.
• NutriBullet: NutriBullet became a victim of a Magecart attack, with payment card skimming code infecting the firm's e-commerce store.
• Marriott: Marriott disclosed a new data breach impacting 5.2 million hotel guests.




APRIL:
• US Small Business Administration (SBA): Up to 8,000 applicants for emergency loans were embroiled in a PII data leak.
• Nintendo: 160,000 users were affected by a mass account hijacking campaign.
• Email.it: The Italian email provider failed to protect the data of 600,000 users, leading to its sale on the Dark Web.
• Nintendo: Nintendo said 160,000 users were impacted by a mass account hijacking account caused by the NNID legacy login system.
• US Small Business Administration (SBA): The SBA revealed as many as 8,000 business emergency loan applicants were involved in a data breach.


MAY:
• EasyJet: The budget airline revealed a data breach exposing data belonging to nine million customers, including some financial records.
• Blackbaud: The cloud service provider was hit by ransomware operators who hijacked customer systems. The company later paid a ransom to stop client data from being leaked online.
• Mitsubishi: A data breach suffered by the company potentially also resulted in confidential missile design data being stolen.
• Toll Group: The logistics giant was hit by a second ransomware attack in three months.
• Pakistani mobile users: Data belonging to 44 million Pakistani mobile users was leaked online.
• Illinois: The Illinois Department of Employment Security (IDES) leaked records concerning citizens applying for unemployment benefits.
• Wishbone: 40 million user records were published online by the ShinyHunters hacking group.
• EasyJet: An £18 billion class-action lawsuit was launched to compensate customers impacted by a data breach in the same month.


JUNE:
• Amtrak: Customer PII was leaked and some Amtrak Guest Rewards accounts were accessed by hackers.
• University of California SF: The university paid a $1.14 million ransom to hackers in order to save COVID-19 research.
• AWS: AWS mitigated a massive 2.3 Tbps DDoS attack.
• Postbank: A rogue employee at the South African bank obtained a master key and stole $3.2 million.
• NASA: The DopplePaymer ransomware gang claimed to have breached a NASA IT contractor's networks.
• Claire's: The accessories company fell prey to a card-skimming Magecart infection.


JULY:
• CouchSurfing: 17 million records belonging to CouchSurfing were found on an underground forum.
• University of York: The UK university disclosed a data breach caused by Blackbaud. Staff and student records were stolen.
• MyCastingFile: A US casting platform for actors exposed the PII of 260,000 users.
• SigRed: Microsoft patched a 17-year-old exploit that could be used to hijack Microsoft Windows Servers.
• MGM Resorts: A hacker put the records of 142 million MGM guests online for sale.
• V Shred: The PII of 99,000 customers and trainers was exposed online and V Shred only partially resolved the problem.
• BlueLeaks: Law enforcement closed down a portal used to host 269 GB in stolen files belonging to US police departments.
• EDP: The energy provider confirmed a Ragnar Locker ransomware incident. Over 10TB in business records were apparently stolen.
• MongoDB: A hacker attempted to ransom 23,000 MongoDB databases.


AUGUST:
• Cisco: A former engineer pleaded guilty to causing massive amounts of damage to Cisco networks, costing the company $2.4 million to fix.
• Canon: The photography giant was struck by ransomware gang Maze.
• LG, Xerox: Maze struck again, publishing data belonging to these companies after failing to secure blackmail payments.
• Intel: 20GB of sensitive, corporate data belonging to Intel was published online.
• The Ritz, London: Fraudsters posed as staff in a clever phishing scam against Ritz clients.
• Freepik: The free photos platform disclosed a data breach impacting 8.3 million users.
• University of Utah: The university gave in to cybercriminals and paid a $457,000 ransom to stop the group from publishing student information.
• Experian, South Africa: Experian's South African branch disclosed a data breach impacting 24 million customers.
• Carnival: The cruise operator disclosed a ransomware attack and subsequent data breach.


SEPTEMBER:
• Nevada: A Nevada school, suffering a ransomware attack, refused to pay the cybercriminals -- and so student data was published online in retaliation.
• German hospital ransomware: A hospital patient passed away after being redirected away from a hospital suffering an active ransomware infection.
• Belarus law enforcement: The private information of 1,000 high-ranking police officers was leaked.
• NS8: The CEO of the cyberfraud startup was accused of defrauding investors out of $123 million.
• Satellites: Iranian hackers were charged for compromising US satellites.
• Cerberus: The developers of the Cerberus banking Trojan released the malware's source code after failing to sell it privately.
• BancoEstado: The Chilean bank was forced to close down branches due to ransomware.

OCTOBER:
• Barnes & Noble: The bookseller experienced a cyberattack, believed to be the handiwork of the ransomware group Egregor. Stolen records were leaked online as proof.
• UN IMO: The United Nations International Maritime Organization (UN IMO) disclosed a security breach affecting public systems.
• Boom! Mobile: The telecom service provider became the victim of a Magecart card-skimming attack.
• Google: Google said it mitigated a 2.54 Tbps DDoS attack, one of the largest ever recorded.
• Dickey's: The US barbeque restaurant chain suffered a point-of-sale attack between July 2019 and August 2020. Three million customers had their card details later posted online. 
• Ubisoft, Crytek: Sensitive information belonging to the gaming giants was released online by the Egregor ransomware gang.
• Amazon insider trading: A former Amazon finance manager and their family were charged for running a $1.4 million insider trading scam.

NOVEMBER:
• Manchester United: Manchester United football club said it was investigating a security incident impacting internal systems.
• Vertafore: 27.7 million Texas drivers' PII was compromised due to "human error."
• Campari: Campari was knocked offline following a ransomware attack.
• $100 million botnet: A Russian hacker was jailed for operating a botnet responsible for draining $100 million from victim bank accounts.
• Mashable: A hacker published a copy of a Mashable database online.
• Capcom: Capcom became a victim of the Ragnar Locker ransomware, disrupting internal systems.
• Home Depot: The US retailer agreed to a $17.5 million settlement after a PoS malware infection impacted millions of shoppers.

Read More

Throwbin, Anonfiles Google Search Engine

 For Throwbin, use this link

For Anonfiles, use this link

Read More

Search infinite security cameras on Google

 List Commands Cameras For Google Search

inurl:"ViewerFrame?Mode=
intitle:Axis 2400 video server
inurl:/view.shtml
intitle:"Live View / - AXIS" | inurl:view/view.shtml^
inurl:ViewerFrame?Mode=
inurl:ViewerFrame?Mode=Refresh
inurl:axis-cgi/jpg
inurl:axis-cgi/mjpg (motion-JPEG)
inurl:view/indexFrame.shtml
inurl:view/index.shtml
inurl:view/view.shtml
liveapplet
intitle:"live view" intitle:axis
intitle:liveapplet
allintitle:"Network Camera NetworkCamera"
intitle:axis intitle:"video server"
intitle:liveapplet inurl:LvAppl
intitle:"EvoCam" inurl:"webcam.html"
intitle:"Live NetSnap Cam-Server feed"
intitle:"Live View / - AXIS"
intitle:"Live View / - AXIS 206M"
intitle:"Live View / - AXIS 206W"
intitle:"Live View / - AXIS 210?
inurl:indexFrame.shtml Axis
inurl:"MultiCameraFrame?Mode=Motion"
intitle:start inurl:cgistart
intitle:"WJ-NT104 Main Page"
intext:"MOBOTIX M1? intext:"Open Menu"
intext:"MOBOTIX M10? intext:"Open Menu" wow
intext:"MOBOTIX D10? intext:"Open Menu"
intitle:snc-z20 inurl:home/
intitle:snc-cs3 inurl:home/
intitle:snc-rz30 inurl:home/
intitle:"sony network camera snc-p1?
intitle:"sony network camera snc-m1?
site:.viewnetcam.com -www.viewnetcam.com
intitle:"Toshiba Network Camera" user login
intitle:"netcam live image"
intitle:"i-Catcher Console - Web Monitor"
inurl:/view.shtml
intitle:”Live View / - AXIS” | inurl:view/view.shtml^
inurl:ViewerFrame?Mode=
inurl:ViewerFrame?Mode=Refresh
inurl:axis-cgi/jpg
inurl:axis-cgi/mjpg (motion-JPEG)
inurl:view/indexFrame.shtml
inurl:view/index.shtml
inurl:view/view.shtml
liveapplet
intitle:”live view” intitle:axis
intitle:liveapplet
allintitle:”Network Camera NetworkCamera”
intitle:axis intitle:”video server”
intitle:liveapplet inurl:LvAppl
intitle:”EvoCam” inurl:”webcam.html”
intitle:”Live NetSnap Cam-Server feed”
intitle:”Live View / - AXIS”
intitle:”Live View / - AXIS 206M”
intitle:”Live View / - AXIS 206W”
intitle:”Live View / - AXIS 210″
inurl:indexFrame.shtml Axis
inurl:”MultiCameraFrame?Mode=Motion”
intitle:start inurl:cgistart
intitle:”WJ-NT104 Main Page”
intitle:snc-z20 inurl:home/
intitle:snc-cs3 inurl:home/
intitle:snc-rz30 inurl:home/
intitle:”sony network camera snc-p1″
intitle:”sony network camera snc-m1″
site:.viewnetcam.com -www.viewnetcam.com
intitle:”Toshiba Network Camera” user login
intitle:”netcam live image”
intitle:”i-Catcher Console - Web Monitor”
allintitle: "Network Camera NetworkCamera" Network cameras
intitle:Axis 2400 video server Mostly security cameras, car parks, colleges, clubs, bars, etc.
intitle:axis intitle:"video server" Mostly security cameras, car parks, colleges, bars, ski slopes etc.<
intitle:"EvoCam" inurl:"webcam.html" Mostly European security cameras
intitle:"Live NetSnap Cam-Server feed" Network cameras, private and non private web cameras
intitle:"Live View / - AXIS" Mostly security cameras, car parks, colleges etc.
intitle:"LiveView / - AXIS" | inurl:view/view.shtml Mostly security cameras, car parks, colleges etc.
intitle:liveapplet Mostly security cameras, car parks, colleges, clubs, bars etc.
intitle:snc-cs3 inurl:home/ Mostly security cameras, swimming pools and more etc.
intitle:"snc-rz30 home" Mostly security cameras, shops, car parks
intitle:snc-z20 inurl:home/ Mostly security cameras, swimming pools and more etc.
intitle:"WJ-NT104 Main" Mostly security cameras, shops, car parks
inurl:LvAppl intitle:liveapplet Mostly security cameras, car parks, colleges etc.
inurl:indexFrame.shtml "Axis Video Server" Mostly security cameras, car parks, colleges etc.
inurl:lvappl A huge list of webcams around the world, mostly security cameras, car parks, colleges etc.
inurl:axis-cgi/jpg Mostly security cameras
inurl:indexFrame.shtml Axis Mostly security cameras, car parks, colleges etc.
inurl:"MultiCameraFrame?Mode=Motion" Mostly security cameras, pet shops, colleges etc.
inurl:/view.shtml Mostly security cameras, car parks, colleges etc.
inurl:/view/index.shtml Mostly security cameras, airports, car parks, back gardens, traffic cams etc.
inurl:viewerframe?mode= Network cameras, mostly private webcams etc.
inurl:"viewerframe?mode=motion" Network cameras
inurl:ViewerFrame?Mode=Refresh Mostly security cameras, parks, bird tables etc.

Other searches:

control/userimage.html
liveapplet
inurl:indexframe.shtml
inurl:"view/index.shtml"
inurl:"view/indexFrame.shtml"
inurl:view/view.shtml
inurl:/view/view.shtml?videos=
inurl:ViewerFrame?Mode=
inurl:ViewerFrame?Mode=Motion
inurl:ViewerFrame?Mode=Refresh
site:.viewnetcam.com -www.viewnetcam.com
/view/index.shtml

In Title:

intitle:"live view" intitle:axis
intitle:"EvoCam" inurl:"webcam.html"
intitle:"i-Catcher Console - Web Monitor"
intitle:"Live NetSnap Cam-Server feed"
allintitle:liveapplet
intitle:liveapplet
intitle:"netcam live image"
intitle:"snc-rz30 home"
intitle:"WJ-NT104 Main"

In URL:

inurl:axis-cgi/jpg
inurl:indexFrame.shtml Axis
inurl:indexFrame.shtml "Axis Video Server"
inurl:lvappl live webcams
inurl:LvAppl intitle:liveapplet
inurl:"MultiCameraFrame?Mode=Motion"
inurl:/view:shtml
inurl:/view/index.shtml
inurl:view/indexframe.shtml
inurl:view/view.shtml
viewerframe?mode=
inurl:"viewerframe?mode=motion"
inurl:ViewerFrame?Mode=Refresh
intitle:"Live NetSnap Cam-Server feed"
inurl:"MultiCameraFrame?Mode="
inurl:CgiStart?page=Single
inurl:indexFrame.shtml?newstyle=Quad
intitle:liveapplet inurl:LvAppl
inurl:video.cgi?resolution=
intitle:"Live View / - AXIS"
inurl:view/view.shtml
intitle:snc-rz30
intitle:"EvoCam" inurl:"webcam.html"
inurl:indexFrame.shtml Axis
inurl:" ViewerFrame?Mode= "
inurl:"MultiCameraFrame?Mode=Motion"
intitle:start inurl:cgistart
intext:"MOBOTIX M1" intext:"Open Menu"
intext:"MOBOTIX M10" intext:"Open Menu"
intext:"MOBOTIX D10" intext:"Open Menu"
intitle:"sony network camera snc-p1"
intitle:"Toshiba Network Camera" user login
intitle:"netcam live image"
intitle:"i-Catcher Console - Web Monitor"
inurl:home/homeJ.html
intitle:"WJ-NT104 Main Page"
intitle:snc-z20 inurl:home/
intitle:snc-cs3 inurl:home/
intitle:snc-rz30 inurl:home/
intitle:"sony network camera snc-m1"
inurl:/home/home
intitle:"Live View / - AXIS 206M"
intitle:"Live View / - AXIS 206W"
intitle:"Live View / - AXIS 210"
inurl:ViewerFrame?Mode=
inurl:MUltiCameraFrame:?Mode=
inurl:view/index.shtml
inurl:indexFrame.shtml Axis
inurl:"ViewerFrame?Mode="
intitle:snc-rz30 inurl:home/
inurl:/view/index.shtml
inurl:"ViewerFrame?Mode="
inurl:netw_tcp.shtml
intitle:"supervisioncam protocol"
inurl:CgiStart?page=Single
inurl:indexFrame.shtml?newstyle=Quad
intitle:liveapplet inurl:LvAppl
inurl:/showcam.php?camid
inurl:video.cgi?resolution=
inurl:image?cachebust=
intitle:"Live View / - AXIS"
inurl:view/view.shtml
intext:"MOBOTIX M1"
intext:"Open Menu"
intitle:snc-rz30
inurl:home/
inurl:"MultiCameraFrame?Mode="
intitle:"EvoCam" inurl:"webcam.html"
intitle:"Live NetSnap Cam-Server feed"
intitle:"Live View / - AXIS 206M"
intitle:"Live View / - AXIS 206W"
intitle:"Live View / - AXIS 210"
inurl:indexFrame.shtml Axis
inurl:"ViewerFrame?Mode="
inurl:"MultiCameraFrame?Mode=Motion"
intitle:start inurl:cgistart
intitle:"WJ-NT104 Main Page"
intext:"MOBOTIX M1" intext:"Open Menu"
intext:"MOBOTIX M10" intext:"Open Menu"
intext:"MOBOTIX D10" intext:"Open Menu"
intitle:snc-z20 inurl:home/
intitle:snc-cs3 inurl:home/
intitle:snc-rz30 inurl:home/
intitle:"sony network camera snc-p1"
intitle:"sony network camera snc-m1"
site:.viewnetcam.com -www.viewnetcam.com
intitle:"Toshiba Network Camera" user login
intitle:"netcam live image"
intitle:"i-Catcher Console - Web Monitor"
inurl:/home/home
"Kamerainformationen anzeigen"
intitle:"AXIS 2100 Network Camera Axis 2100 Network Camera 2.02"
intitle:"Linksys Web Camera" "ver"
Copy/paste to google

Read More

Using Hydra to HACK any e-mail

Type hydra in kali terminal or in terminal in other linux operating systems whereever hydra is installed. After you enter hydra and click on enter, you can find information on how to use hydra. As per this post I will show you command to hack into any email.

hydra -l < mail address> -P -s < port > -S -v -V -t < number of tasks> < mailer server > smtp

Below are port numbers and server links.

Yahoo
Server SMTP.mail.Yahoo.com
Port 465


Gmail
Server smtp.Gmail.com
Port 465


Hotmail
Server smtp. Live.com
Port 587

Read More

Advanced way of searching in GOOGLE

Operator	How to Use It	Examples
* (Asterisk)	Add the asterisk as a placeholder for an unknown word or fact	Find quotes that start with "Life is like": Life is like a *
" (Quotation marks)	Look for an exact word or phrase by putting it in quotes	Find pages that talk about the book One Hundred Years of Solitude: "One Hundred Years of Solitude"
- (Hyphen)	Use a hyphen before a word or site to exclude it from your search results	Omit Wikipedia pages from search results: -site:wikipedia.org. Narrow results to the band R.E.M., not rapid eye movement: R.E.M. -sleep
.. (Two Periods)	Separate numbers with two periods without spaces to search for numbers within that range	Find phones that cost between $200 and $400: Android phone $200..$400. Find computer milestones that took place between 1950 and 2000: "computer milestones" 1950..2000
allintitle:	Use allintext:[search phrase] to find pages with all of those words in the title of the page	Show pages that have both "Apple" and "notebook" in the title: allintitle:Apple notebook
allintext:	Use allintext:[search phrase] to find pages with all of those words in the body of the page	Show pages that mention Roth, IRA, and investments in the body: allintext:Roth IRA investments
allinurl:	Use allinurl:[search phrase] to find pages with all of those words in the URL	Show pages that have both "Microsoft" and "Surface" in the URL: allinurl:Microsoft Surface
AROUND(n)	Add AROUND(n) between two search terms to find pages where those terms are written on the page in close proximity. The number you choose in place of n sets the maximum distance between the terms. This is useful for finding relationships between two search terms.	Find pages that mention Facebook and Microsoft in the same sentence or paragraph: Facebook AROUND(7) Microsoft
site:	Use site:[URL] to limit search results to a specific website	Find pages on Zapier that mention trello: site:zapier.com Trello
related:	Use related:[URL] to find sites similar to a specific website	Find websites similar to Zapier: related:zapier.com
filetype:	Use filetype:[suffix] to limit results to a certain file format, such as PDF or DOC.	Find keyboard shortcuts for Microsoft Office that are shared as PDF: filetype:pdf office keyboard shortcuts
intitle:	Use intitle:[search phrase] to search for pages that have at least one of your search words in the title	Show pages that have "Apple" or "notebook" or both in the title: intitle:Apple notebook
intext:	Use intext:[search phrase] to search for pages that have at least one of your search words in the body of the page	Show pages that mention Roth, IRA, and/or investments in the body: intext:Roth IRA investments
inurl:	Use inurl:[search phrase] to search for pages that have at least one of your search words in the URL	Show pages that mention Roth, IRA, and/or investments in the body: intext:Roth IRA investments
OR	Perform two search queries at the same time by separating your search terms with OR. This will find pages that might one of several words.	Search for pages that reference "Google Drive," "Dropbox," or "OneDrive": "Google Drive" OR Dropbox OR OneDrive

For example if we want to search some txt file or pdf in a website or relevant, we will type in google as

Within website with extension: inurl:"websitename.com" filetype:txt 

Relavent info with extension: intext:"passlist" filetype:txt

Read More

Listing of a number of useful Google dorks

Explanations:

cache: If you include other words in the query, Google will highlight those words within

 the cached document. For instance, [cache:www.google.com web] will show the cached

 content with the word “web” highlighted. This functionality is also accessible by

 clicking on the “Cached” link on Google’s main results page. The query [cache:] will

 show the version of the web page that Google has in its cache. For instance,

 [cache:www.google.com] will show Google’s cache of the Google homepage. Note there

 can be no space between the “cache:” and the web page url.

------------------------------------------------------------------------------------------

link: The query [link:] will list webpages that have links to the specified webpage.

 For instance, [link:www.google.com] will list webpages that have links pointing to the

 Google homepage. Note there can be no space between the “link:” and the web page url.

------------------------------------------------------------------------------------------

related: The query [related:] will list web pages that are “similar” to a specified web

 page. For instance, [related:www.google.com] will list web pages that are similar to

 the Google homepage. Note there can be no space between the “related:” and the web

 page url.

------------------------------------------------------------------------------------------

info: The query [info:] will present some information that Google has about that web

 page. For instance, [info:www.google.com] will show information about the Google

 homepage. Note there can be no space between the “info:” and the web page url.

------------------------------------------------------------------------------------------

define: The query [define:] will provide a definition of the words you enter after it,

 gathered from various online sources. The definition will be for the entire phrase

 entered (i.e., it will include all the words in the exact order you typed them).

------------------------------------------------------------------------------------------

stocks: If you begin a query with the [stocks:] operator, Google will treat the rest

 of the query terms as stock ticker symbols, and will link to a page showing stock

 information for those symbols. For instance, [stocks: intc yhoo] will show information

 about Intel and Yahoo. (Note you must type the ticker symbols, not the company name.)

------------------------------------------------------------------------------------------

site: If you include [site:] in your query, Google will restrict the results to those

 websites in the given domain. For instance, [help site:www.google.com] will find pages

 about help within www.google.com. [help site:com] will find pages about help within

 .com urls. Note there can be no space between the “site:” and the domain.

------------------------------------------------------------------------------------------

allintitle: If you start a query with [allintitle:], Google will restrict the results

 to those with all of the query words in the title. For instance,

 [allintitle: google search] will return only documents that have both “google”

 and “search” in the title.

------------------------------------------------------------------------------------------

intitle: If you include [intitle:] in your query, Google will restrict the results

 to documents containing that word in the title. For instance, [intitle:google search]

 will return documents that mention the word “google” in their title, and mention the

 word “search” anywhere in the document (title or no). Note there can be no space

 between the “intitle:” and the following word. Putting [intitle:] in front of every

 word in your query is equivalent to putting [allintitle:] at the front of your

 query: [intitle:google intitle:search] is the same as [allintitle: google search].

------------------------------------------------------------------------------------------

allinurl: If you start a query with [allinurl:], Google will restrict the results to

 those with all of the query words in the url. For instance, [allinurl: google search]

 will return only documents that have both “google” and “search” in the url. Note

 that [allinurl:] works on words, not url components. In particular, it ignores

 punctuation. Thus, [allinurl: foo/bar] will restrict the results to page with the

 words “foo” and “bar” in the url, but won’t require that they be separated by a

 slash within that url, that they be adjacent, or that they be in that particular

 word order. There is currently no way to enforce these constraints.

------------------------------------------------------------------------------------------

inurl: If you include [inurl:] in your query, Google will restrict the results to

 documents containing that word in the url. For instance, [inurl:google search] will

 return documents that mention the word “google” in their url, and mention the word

 “search” anywhere in the document (url or no). Note there can be no space between

 the “inurl:” and the following word. Putting “inurl:” in front of every word in your

 query is equivalent to putting “allinurl:” at the front of your query:

 [inurl:google inurl:search] is the same as [allinurl: google search].

------------------------------------------------------------------------------------------

Nina Simone intitle:”index.of” “parent directory” “size” “last modified” “description” I Put A Spell On You (mp4|mp3|avi|flac|aac|ape|ogg) -inurl:(jsp|php|html|aspx|htm|cf|shtml|lyrics-realm|mp3-collection) -site:.info

Bill Gates intitle:”index.of” “parent directory” “size” “last modified” “description” Microsoft (pdf|txt|epub|doc|docx) -inurl:(jsp|php|html|aspx|htm|cf|shtml|ebooks|ebook) -site:.info

parent directory /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums

parent directory DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums

parent directory Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums

parent directory Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums

parent directory MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums

parent directory Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums

filetype:config inurl:web.config inurl:ftp

“Windows XP Professional” 94FBR

ext:(doc | pdf | xls | txt | ps | rtf | odt | sxw | psw | ppt | pps | xml) (intext:confidential salary | intext:"budget approved") inurl:confidential

ext:(doc | pdf | xls | txt | ps | rtf | odt | sxw | psw | ppt | pps | xml) (intext:confidential salary | intext:”budget approved”) inurl:confidential

ext:inc "pwd=" "UID="

ext:ini intext:env.ini

ext:ini Version=... password

ext:ini Version=4.0.0.4 password

ext:ini eudora.ini

ext:ini intext:env.ini

ext:log "Software: Microsoft Internet Information Services *.*"

ext:log "Software: Microsoft Internet Information

ext:log "Software: Microsoft Internet Information Services *.*"

ext:log \"Software: Microsoft Internet Information Services *.*\"

ext:mdb   inurl:*.mdb inurl:fpdb shop.mdb

ext:mdb inurl:*.mdb inurl:fpdb shop.mdb

ext:mdb inurl:*.mdb inurl:fpdb shop.mdb

filetype:SWF SWF

filetype:TXT TXT

filetype:XLS XLS

filetype:asp   DBQ=" * Server.MapPath("*.mdb")

filetype:asp "Custom Error Message" Category Source

filetype:asp + "[ODBC SQL"

filetype:asp DBQ=" * Server.MapPath("*.mdb")

filetype:asp DBQ=\" * Server.MapPath(\"*.mdb\") 

filetype:asp “Custom Error Message” Category Source

filetype:bak createobject sa

filetype:bak inurl:"htaccess|passwd|shadow|htusers"

filetype:bak inurl:\"htaccess|passwd|shadow|htusers\" 

filetype:conf inurl:firewall -intitle:cvs 

filetype:conf inurl:proftpd. PROFTP FTP server configuration file reveals

filetype:dat "password.dat

filetype:dat \"password.dat\" 

filetype:eml eml +intext:"Subject" +intext:"From" +intext:"To"

filetype:eml eml +intext:\"Subject\" +intext:\"From\" +intext:\"To\" 

filetype:eml eml +intext:”Subject” +intext:”From” +intext:”To”

filetype:inc dbconn 

filetype:inc intext:mysql_connect

filetype:inc mysql_connect OR mysql_pconnect 

filetype:log inurl:"password.log"

filetype:log username putty PUTTY SSH client logs can reveal usernames

filetype:log “PHP Parse error” | “PHP Warning” | “PHP Error”

filetype:mdb inurl:users.mdb

filetype:ora ora

filetype:ora tnsnames

filetype:pass pass intext:userid

filetype:pdf "Assessment Report" nessus

filetype:pem intext:private

filetype:properties inurl:db intext:password

filetype:pst inurl:"outlook.pst"

filetype:pst pst -from -to -date

filetype:reg reg +intext:"defaultusername" +intext:"defaultpassword"

filetype:reg reg +intext:\"defaultusername\" +intext:\"defaultpassword\" 

filetype:reg reg +intext:â? WINVNC3â?

filetype:reg reg +intext:”defaultusername” +intext:”defaultpassword”

filetype:reg reg HKEY_ Windows Registry exports can reveal

filetype:reg reg HKEY_CURRENT_USER SSHHOSTKEYS

filetype:sql "insert into" (pass|passwd|password)

filetype:sql ("values * MD5" | "values * password" | "values * encrypt")

filetype:sql (\"passwd values\" | \"password values\" | \"pass values\" ) 

filetype:sql (\"values * MD\" | \"values * password\" | \"values * encrypt\") 

filetype:sql +"IDENTIFIED BY" -cvs

filetype:sql password

filetype:sql password 

filetype:sql “insert into” (pass|passwd|password)

filetype:url +inurl:"ftp://" +inurl:";@"

filetype:url +inurl:\"ftp://\" +inurl:\";@\" 

filetype:url +inurl:”ftp://” +inurl:”;@”

filetype:xls inurl:"email.xls"

filetype:xls username password email

index of: intext:Gallery in Configuration mode

index.of passlist

index.of perform.ini mIRC IRC ini file can list IRC usernames and

index.of.dcim 

index.of.password 

intext:" -FrontPage-" ext:pwd inurl:(service | authors | administrators | users)

intext:""BiTBOARD v2.0" BiTSHiFTERS Bulletin Board"

intext:"# -FrontPage-" ext:pwd inurl:(service | authors | administrators | users) "# -FrontPage-" inurl:service.pwd

intext:"#mysql dump" filetype:sql

intext:"#mysql dump" filetype:sql 21232f297a57a5a743894a0e4a801fc3

intext:"A syntax error has occurred" filetype:ihtml

intext:"ASP.NET_SessionId" "data source="

intext:"About Mac OS Personal Web Sharing"

intext:"An illegal character has been found in the statement" -"previous message"

intext:"AutoCreate=TRUE password=*"

intext:"Can't connect to local" intitle:warning

intext:"Certificate Practice Statement" filetype:PDF | DOC

intext:"Certificate Practice Statement" inurl:(PDF | DOC)

intext:"Copyright (c) Tektronix, Inc." "printer status"

intext:"Copyright © Tektronix, Inc." "printer status"

intext:"Emergisoft web applications are a part of our"

intext:"Error Diagnostic Information" intitle:"Error Occurred While"

intext:"Error Message : Error loading required libraries."

intext:"Establishing a secure Integrated Lights Out session with" OR intitle:"Data Frame - Browser not HTTP 1.1 compatible" OR intitle:"HP Integrated Lights-

intext:"Fatal error: Call to undefined function" -reply -the -next

intext:"Fill out the form below completely to change your password and user name. If new username is left blank, your old one will be assumed." -edu

intext:"Generated   by phpSystem"

intext:"Generated by phpSystem"

intext:"Host Vulnerability Summary Report"

intext:"HostingAccelerator" intitle:"login" +"Username" -"news" -demo

intext:"IMail Server Web Messaging" intitle:login

intext:"Incorrect syntax near"

intext:"Index of" /"chat/logs"

intext:"Index of /network" "last modified"

intext:"Index of /" +.htaccess

intext:"Index of /" +passwd

intext:"Index of /" +password.txt

intext:"Index of /admin"

intext:"Index of /backup"

intext:"Index of /mail"

intext:"Index of /password"

intext:"Microsoft (R) Windows * (TM) Version * DrWtsn32 Copyright (C)" ext:log

intext:"Microsoft CRM : Unsupported Browser Version"

intext:"Microsoft ® Windows * ™ Version * DrWtsn32 Copyright ©" ext:log

intext:"Network Host Assessment Report" "Internet Scanner"

intext:"Network Vulnerability   Assessment Report"

intext:"Network Vulnerability Assessment Report"

intext:"Network Vulnerability Assessment Report" 本文来自 pc007.com

intext:"SQL Server Driver][SQL Server]Line 1: Incorrect syntax near"

intext:"Thank you for your order"   +receipt

intext:"Thank you for your order" +receipt

intext:"Thank you for your purchase" +download

intext:"The following report contains confidential information" vulnerability -search

intext:"phpMyAdmin MySQL-Dump" "INSERT INTO" -"the"

intext:"phpMyAdmin MySQL-Dump" filetype:txt

intext:"phpMyAdmin" "running on" inurl:"main.php"

intextpassword | passcode)   intextusername | userid | user) filetype:csv

intextpassword | passcode) intextusername | userid | user) filetype:csv

intitle:"index of" +myd size

intitle:"index of" etc/shadow

intitle:"index of" htpasswd

intitle:"index of" intext:connect.inc

intitle:"index of" intext:globals.inc

intitle:"index of" master.passwd

intitle:"index of" master.passwd 007电脑资讯

intitle:"index of" members OR accounts

intitle:"index of" mysql.conf OR mysql_config

intitle:"index of" passwd

intitle:"index of" people.lst

intitle:"index of" pwd.db

intitle:"index of" spwd

intitle:"index of" user_carts OR user_cart

intitle:"index.of *" admin news.asp configview.asp

intitle:("TrackerCam Live Video")|("TrackerCam Application Login")|("Trackercam Remote") -trackercam.com

intitle:(“TrackerCam Live Video”)|(“TrackerCam Application Login”)|(“Trackercam Remote”) -trackercam.com

inurl:admin inurl:userlist Generic userlist files

------------------------------------------------------------------------------------------

Using special search string to find vulnerable websites:

inurl:php?=id1

inurl:index.php?id=

inurl:trainers.php?id=

inurl:buy.php?category=

inurl:article.php?ID=

inurl:play_old.php?id=

inurl:declaration_more.php?decl_id=

inurl:pageid=

inurl:games.php?id=

inurl:page.php?file=

inurl:newsDetail.php?id=

inurl:gallery.php?id=

inurl:article.php?id=

inurl:show.php?id=

inurl:staff_id=

inurl:newsitem.php?num= andinurl:index.php?id=

inurl:trainers.php?id=

inurl:buy.php?category=

inurl:article.php?ID=

inurl:play_old.php?id=

inurl:declaration_more.php?decl_id=

inurl:pageid=

inurl:games.php?id=

inurl:page.php?file=

inurl:newsDetail.php?id=

inurl:gallery.php?id=

inurl:article.php?id=

inurl:show.php?id=

inurl:staff_id=

inurl:newsitem.php?num=

Read More