Google Hacking Diggity Project

Attack Tools

Sometimes, the best defense is a good offense. Bishop Fox’s attack tools for Google Hacking level the playing field by allowing our clients to find information disclosures and exposed vulnerabilities before others do. Arm yourself with our arsenal of attack tools that leverage Google, Bing, and other popular search engines.The activity folio contains downloads and links to our best Google Hacking analysis and chargeless aegis tools. Defensive strategies are additionally introduced, including avant-garde solutions that use Google Alerts to adviser your arrangement and systems.


SearchDiggity by Bishop Fox. The Search Engine Hacking Tool Arsenal. Part of the Google Hacking Diggity Project.

SearchDiggity

SearchDiggity v 3

SearchDiggity 3.1 is the primary attack tool of the Google Hacking Diggity Project. It is Bishop Fox’s MS Windows GUI application that serves as a front-end to the most recent versions of our Diggity tools: GoogleDiggity, BingDiggity, Bing LinkFromDomainDiggity, CodeSearchDiggity, DLPDiggity, FlashDiggity, MalwareDiggity, PortScanDiggity, SHODANDiggity, BingBinaryMalwareSearch, and NotInMyBackYard Diggity.

SearchDiggity - Tool List. Search engine hacking tools for Google Hacking, that also leverage Bing, SHODAN, and other search engines as well.
SearchDiggity – Tool List
Note: To avoid Google/Bing bot detection which causes SearchDiggity to pause and display the error “Auto-resuming in 15 minutes.“, see this blog post on using the official APIs provided by Google/Bing/SHODAN.

Hacking Dictionaries

Bing Hacking Database - BHDB v2

BHDB v2.0 - Bing Hacking Database by Bishop Fox.Exploiting recent API changes and undocumented features within Bing, we’ve been able to completely overcome the previous Bing hacking limitations (such as the;disabling of the inurl:, link: and linkdomain: search operators) to create an entirely new BHDB v2.0 that makes Bing hacking just as effective as Google hacking (if not more so) for uncovering vulnerabilities and data leaks on the web.

For example, Bing now has ability to use the ext: search operator, which previously didn’t exist. Bing also now has the ability to mimic Google’s inurl: search operator by using Bing’s instreamset:url: search operator.

Bing Hacking. Using Bing to find vulnerabilities via the instreamset:URL: search operator.
BHDB v2.0 – Bing Hacking Database by Bishop Fox. Mimicking Google’s inurl: search operator by using Bing’s instreamset:url: search operator.

The BHDB v2.0 also includes an entirely new SharePoint Bing Hacking database, containing attack strings targeting Microsoft SharePoint deployments via Bing.

SharePoint - Google and Bing Hacking Dictionary Files

New GoogleDiggity input dictionary file contains 121 queries that allow users to uncover SharePoint specific vulnerabilities exposed via the Google search engine. This dictionary helps assessors locate exposures of common SharePoint administrative pages, web services, and site galleries that an organization typically would not want to be made available to the public, let alone indexed by Google.

SharePoint hacking via Google. SharePoint - Google and Bing Hacking Dictionary Files
SharePoint hacking via Google. Uncovering SharePoint specific vulnerabilities exposed via the Google search engine.

It can be imported for use within the SearchDiggity GUI tool from the menu: “File”->”Import Query Definition”.

Recently, we’ve also created a Bing hacking dictionary that can be imported into BingDiggity and used to identify SharePoint exposures as well.

SharePoint hacking via Bing. SharePoint - Google and Bing Hacking Dictionary Files
SharePoint hacking via Bing. Uncovering SharePoint specific vulnerabilities exposed via the Bing search engine.

GHDB Reborn Dictionaries - Exploit-DB

The good folks over at Exploit-DB.com were kind enough to pick up where Johnny Long left off and resurrect the GHDB. They now maintain an updated version of the GHDB in a project labeled Google Hacking Database Reborn.

GHDB Reborn - New-v2

In that same spirit, we at the Diggity project were kind enough to translate their efforts into GoogleDiggity compatible input text files. These dorks are included with the standard SearchDiggity dictionary set, and can also be downloaded below.

SHODAN Hacking Database - SHDB

SHODAN - LogoThe new SHODAN Hacking Database (SHDB) input dictionary file containing 167 queries that allow users to uncover interesting information via the SHODAN search engine. This dictionary helps target various technologies including webcams, printers, VoIP devices, routers, switches, and even SCADA/Industrial Control Systems (ICS) just to name a few. This dictionary comes preloaded with SHODAN Diggity (part of the SearchDiggity attack tool suite), which provides an easy-to-use scanning interface to the popular SHODAN hacking search engine, using the SHODAN API.

Shodan Diggity, part of the SearchDiggity attack tool by Bishop Fox. Comes preloaded with the Shodan Hacking Database (SHDB)
SHODAN Diggity comes preloaded with the 167 queries of the SHODAN Hacking Database (SHDB).

SHODAN is a search engine that lets you find specific types of computers (routers, servers, etc.) using a variety of filters.  Some have also described it as a search engine of service banners. Shodan collects data mostly on web servers at the moment (port 80), but there is also some data from FTP (21), SSH (22) and Telnet (23) services.

Web search engines, such as Google and Bing, are great for finding websites. But what if you’re interested in finding computers running a certain piece of software (such as Apache)? Or you want to see how many anonymous FTP servers there are? Maybe a new vulnerability came out and you want to see how many hosts it could infect? Traditional web search engines don’t let you answer those questions.

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.