diff --git a/README.md b/README.md index 75cbba0..09fd617 100644 --- a/README.md +++ b/README.md @@ -272,6 +272,7 @@ Be carefull using this tool - [Header Email](https://github.com/umair9747/headmail) - [Badan Pemeriksa APK](https://apk.ibnux.com/?s=0) - [SPAMHAUS](https://www.spamhaus.org/) +- [Spiderfoot HX](https://www.spiderfoot.net/open-source-vs-hx/) You must have account # IoT Search Engines @@ -348,8 +349,292 @@ Dorking is a wonderful thing, you can use this technique to search for anything 14. (+) Used to concatenate words, useful to detect pages that use more than one specific key 15. (-) Minus operator avoids showing results that contain certain words, e.g. security -trails will show pages that use "security" in their text, but not those that have the word "trails" -example +Example +``` +".mlab.com password" +"access_key" +"access_token" +"amazonaws" +"api.googlemaps AIza" +"api_key" +"api_secret" +"apidocs" +"apikey" +"apiSecret" +"app_key" +"app_secret" +"appkey" +"appkeysecret" +"application_key" +"appsecret" +"appspot" +"auth" +"auth_token" +"authorizationToken" +"aws_access" +"aws_access_key_id" +"aws_key" +"aws_secret" +"aws_token" +"AWSSecretKey" +"bashrc password" +"bucket_password" +"client_secret" +"cloudfront" +"codecov_token" +"config" +"conn.login" +"connectionstring" +"consumer_key" +"credentials" +"database_password" +"db_password" +"db_username" +"dbpasswd" +"dbpassword" +"dbuser" +"dot-files" +"dotfiles" +"encryption_key" +"fabricApiSecret" +"fb_secret" +"firebase" +"ftp" +"gh_token" +"github_key" +"github_token" +"gitlab" +"gmail_password" +"gmail_username" +"herokuapp" +"internal" +"irc_pass" +"JEKYLL_GITHUB_TOKEN" +"key" +"keyPassword" +"ldap_password" +"ldap_username" +"login" +"mailchimp" +"mailgun" +"master_key" +"mydotfiles" +"mysql" +"node_env" +"npmrc _auth" +"oauth_token" +"pass" +"passwd" +"password" +"passwords" +"pem private" +"preprod" +"private_key" +"prod" +"pwd" +"pwds" +"rds.amazonaws.com password" +"redis_password" +"root_password" +"secret" +"secret.password" +"secret_access_key" +"secret_key" +"secret_token" +"secrets" +"secure" +"security_credentials" +"send.keys" +"send_keys" +"sendkeys" +"SF_USERNAME salesforce" +"sf_username" +"site.com" FIREBASE_API_JSON= +"site.com" vim_settings.xml +"slack_api" +"slack_token" +"sql_password" +"ssh" +"ssh2_auth_password" +"sshpass" +"staging" +"stg" +"storePassword" +"stripe" +"swagger" +"testuser" +"token" +"x-api-key" +"xoxb " +"xoxp" +[WFClient] Password= extension:ica +access_key +bucket_password +dbpassword +dbuser +extension:avastlic "support.avast.com" +extension:bat +extension:cfg +extension:env +extension:exs +extension:ini +extension:json api.forecast.io +extension:json googleusercontent client_secret +extension:json mongolab.com +extension:pem +extension:pem private +extension:ppk +extension:ppk private +extension:properties +extension:sh +extension:sls +extension:sql +extension:sql mysql dump +extension:sql mysql dump password +extension:yaml mongolab.com +extension:zsh +filename:.bash_history +filename:.bash_history DOMAIN-NAME +filename:.bash_profile aws +filename:.bashrc mailchimp +filename:.bashrc password +filename:.cshrc +filename:.dockercfg auth +filename:.env DB_USERNAME NOT homestead +filename:.env MAIL_HOST=smtp.gmail.com +filename:.esmtprc password +filename:.ftpconfig +filename:.git-credentials +filename:.history +filename:.htpasswd +filename:.netrc password +filename:.npmrc _auth +filename:.pgpass +filename:.remote-sync.json +filename:.s3cfg +filename:.sh_history +filename:.tugboat NOT _tugboat +filename:_netrc password +filename:apikey +filename:bash +filename:bash_history +filename:bash_profile +filename:bashrc +filename:beanstalkd.yml +filename:CCCam.cfg +filename:composer.json +filename:config +filename:config irc_pass +filename:config.json auths +filename:config.php dbpasswd +filename:configuration.php JConfig password +filename:connections +filename:connections.xml +filename:constants +filename:credentials +filename:credentials aws_access_key_id +filename:cshrc +filename:database +filename:dbeaver-data-sources.xml +filename:deployment-config.json +filename:dhcpd.conf +filename:dockercfg +filename:environment +filename:express.conf +filename:express.conf path:.openshift +filename:filezilla.xml +filename:filezilla.xml Pass +filename:git-credentials +filename:gitconfig +filename:global +filename:history +filename:htpasswd +filename:hub oauth_token +filename:id_dsa +filename:id_rsa +filename:id_rsa or filename:id_dsa +filename:idea14.key +filename:known_hosts +filename:logins.json +filename:makefile +filename:master.key path:config +filename:netrc +filename:npmrc +filename:pass +filename:passwd path:etc +filename:pgpass +filename:prod.exs +filename:prod.exs NOT prod.secret.exs +filename:prod.secret.exs +filename:proftpdpasswd +filename:recentservers.xml +filename:recentservers.xml Pass +filename:robomongo.json +filename:s3cfg +filename:secrets.yml password +filename:server.cfg +filename:server.cfg rcon password +filename:settings +filename:settings.py SECRET_KEY +filename:sftp-config.json +filename:sftp-config.json password +filename:sftp.json path:.vscode +filename:shadow +filename:shadow path:etc +filename:spec +filename:sshd_config +filename:token +filename:tugboat +filename:ventrilo_srv.ini +filename:WebServers.xml +filename:wp-config +filename:wp-config.php +filename:zhrc +HEROKU_API_KEY language:json +HEROKU_API_KEY language:shell +HOMEBREW_GITHUB_API_TOKEN language:shell +jsforce extension:js conn.login +language:yaml -filename:travis +msg nickserv identify filename:config +org:Target "AWS_ACCESS_KEY_ID" +org:Target "list_aws_accounts" +org:Target "aws_access_key" +org:Target "aws_secret_key" +org:Target "bucket_name" +org:Target "S3_ACCESS_KEY_ID" +org:Target "S3_BUCKET" +org:Target "S3_ENDPOINT" +org:Target "S3_SECRET_ACCESS_KEY" +password +path:sites databases password +private -language:java +PT_TOKEN language:bash +redis_password +root_password +secret_access_key +SECRET_KEY_BASE= +shodan_api_key language:python +WORDPRESS_DB_PASSWORD= +xoxp OR xoxb OR xoxa +s3.yml +.exs +beanstalkd.yml +deploy.rake +.sls +AWS_SECRET_ACCESS_KEY +API KEY +API SECRET +API TOKEN +ROOT PASSWORD +ADMIN PASSWORD +GCP SECRET +AWS SECRET +"private" extension:pgp +``` + > intext:"hacking" site:seccodeid.com +> inurl:login site:seccodeid.com +> intext:username filetype:log > site:www.github.com ext:doc | ext:docx | ext:odt | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv # Bash Dorking Script @@ -415,6 +700,7 @@ for ((i=1;i<=10;i++));do curl -i -s -k -L -X GET -H "User-Agent: Mozilla/5.0 (Wi - [Waymore](https://forum.seccodeid.com/d/waymore-find-way-more-from-the-wayback-machine) - [StartPage](https://www.startpage.com/) - [Searx](https://searx.space/) +- [CommonCrawl](https://commoncrawl.org/latest-crawl) # Internet Archive @@ -487,6 +773,9 @@ This domain will always change - [Netcraft](http://www.netcraft.com) - [Hunter](https://hunter.io/) - [SignalHire](https://www.signalhire.com/) +- [Spiderfoot](https://www.spiderfoot.net/) +- [Spiderfoot HX](https://www.spiderfoot.net/open-source-vs-hx/) You must have account +- [Rocket Reach](https://rocketreach.co/) # People Searching @@ -1262,8 +1551,6 @@ List exploit and vuln cheat sheet walkthrough Example and payload injection - [All about bug bounty](https://github.com/daffainfo/AllAboutBugBounty) Bypasses, payloads, Reconnaissance and etc -- [Searchsploit](https://www.exploit-db.com/searchsploit) -Search more exploit from edb - [DnsSpy](https://github.com/dnSpy/dnSpy) Desktop NET debugger and assembly editor @@ -1379,6 +1666,7 @@ Social Network and blogging - Medium - Facebook - Instagram +- Linkedin # Enhance Image Quality