dork-cli is a Python-based command-line Google Dork Tool to perform searches againsts Google’s custom search engine. A command-line option is always good as it allows you to script it in as part of your automated pen-testing suite.
It will return a list of all the unique page results it finds, optionally filtered by a set of dynamic page extensions.
Any number of additional query terms/dorks can be specified. dork-cli was designed to be piped into an external tool such as a vulnerability scanner for automated testing purposes.
Setup
In order to use this program you need to configure at a minimum two settings: a Google API key and a custom search engine id.
Custom Search Engine:
- Create a custom search engine via https://www.google.com/cse/
- Add your desired domain(s) under “Sites to search”
- Click “Search engine ID” button to reveal the id, or grab it from the “cx” url paramter
API key:
- Open the Google API console at https://code.google.com/apis/console
- Enable the Custom Search API via APIs & auth > APIs
- Create a new API key via APIs & auth > Credentials > Create new Key
- Select “Browser key”, leave HTTP Referer blank and click Create
Usage
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
$ ./dork-cli.py -h usage: dork-cli.py [-h] [-e ENGINE] [-f [FILETYPES]] [-k KEY] [-m MAX_QUERIES] [-s SLEEP] [T [T ...]] Find dynamic pages via Google dorks. positional arguments: T additional search term optional arguments: -h, --help show this help message and exit -e ENGINE, --engine ENGINE Google custom search engine id (cx value) -f [FILETYPES], --filetypes [FILETYPES] File extensions to return (if present but no extensions specified, builtin dynamic list is used) -k KEY, --key KEY Google API key -m MAX_QUERIES, --max-queries MAX_QUERIES Maximum number of queries to issue -s SLEEP, --sleep SLEEP Seconds to sleep before retry if daily API limit is reached (0=disable) |
API Limitations
The free Google API limits you to 100 searches per day, with a maximum of 10 results per search. This means if you configure dork-cli.py to return 100 results, it will issue 10 queries (1/10th of your daily limit) each time it is run. You have the option to pay for additional searches via the Google API console. At the time of writing, signing up for billing on the Google API site gets you $300 free to spend on API calls for 60 days.
You can download dork-cli here:
Or read more here.
By default S3 buckets are not public.
They used to be IIRC, but I could be wrong, well I guess more accurately the easiest way to get access to it programmatically is just to set it to public.
Yes, it had to be configured to be open to the web. This story is not really about AWS. It’s about bad IT controls and careless engineering.
I wouldn’t even call this a hack, if it’s left open to the public.
Broadsoft was responsible for exposing the Time Warner Cable (TWC) data. Time Warner (TC) is an entirely separate entity (TC does NOT = TWC).
Hey thanks for that clarification Alan.
Also time Warner cable is no longer TWC . it is now spectrum.
Buckets have zero access beyond the creator. “Easiest way to grant access is to make it public”… that same statement applies to a cisco firewall in an onprem enterprise. And allow any rule is simple but terribly wrong. IAM or bucket policies are no more complex than any enterprise grade firewall. Lets not excuse the behavior of the admin due to ignorance.
Not excusing it, just saying it happens that way, same reason by MongoDB worked out of the box with no auth and listening on every interface. Not ideal, but a lot of things are done in the name of ease and speed of deployment rather than looking at it with an eye on risk and the repercussions.