GooFuzz - The Power of Google Dorks

Credits

Author: M3n0sD0n4ld

Twitter:@David_Uton

Description:

Download and install:

$ git clone https://github.com/m3n0sd0n4ld/GooFuzz.git$ cd GooFuzz$ chmod +x GooFuzz$ ./GooFuzz -h

Docker version:

$ git clone https://github.com/m3n0sd0n4ld/GooFuzz$ cd GooFuzz$ docker build -t goofuzz .$ docker run --rm -it goofuzz -h

Use:

Menu

> ./GooFuzz -h********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **                                                       ** David Utón (@David_Uton)                              **********************************************************Usage:        -h                                Display this help message.        -w <DICTIONARY>        Specify a DICTIONARY, PATHS or FILES.        -e <EXTENSION>           Specify comma-separated extensions.        -t <TARGET>                  Specify a DOMAIN or IP Address.        -p <PAGES>                      Specify the number of PAGES.        -x <EXCLUSIONS>                EXCLUDES targets in searches.        -d <DELAY>                Delay in seconds between requests.        -s                 Lists subdomains of the specified domain.        -c <TEXT> Specify relevant content in comma-separated files.        -o <FILENAME>   Export the results to a file (results only).        -r <PROXY>        Specify an [protocol://]host[:port] proxy.           Examples:        GooFuzz -t site.com -e pdf,doc,bak        GooFuzz -t site.com -e pdf -p 2        GooFuzz -t www.site.com -e extensionslist.txt        GooFuzz -t www.site.com -w config.php,admin,/images/        GooFuzz -t site.com -w wp-admin -p 1        GooFuzz -t site.com -w wordlist.txt        GooFuzz -t site.com -w login.html -x dev.site.com        GooFuzz -t site.com -w admin.html -x exclusion_list.txt        GooFuzz -t site.com -s -p 10 -d 5 -o GooFuzz-subdomains.txt        GooFuzz -t site.com -c P@ssw0rd!        GooFuzz -t site.com -r http://proxy.example.com:8080

Lists files by extensions separated by commas.

> ./GooFuzz -t nasa.gov -e pdf,bak,old -d 10********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Extension: pdf===================================================================https://history.nasa.gov/alsj/a11/A11_PressKit.pdfhttps://history.nasa.gov/alsj/a13/A13_PressKit.pdfhttps://history.nasa.gov/alsj/a14/A14_PressKit.pdfhttps://history.nasa.gov/alsj/a15/A15_PressKit.pdfhttps://history.nasa.gov/alsj/a410/A07_PressKit.pdfhttps://history.nasa.gov/alsj/a410/A09_PressKit.pdfhttps://history.nasa.gov/monograph15.pdfhttps://www.hq.nasa.gov/alsj/LLRV_Monograph.pdf===================================================================Extension: bak===================================================================https://bocachica.arc.nasa.gov/ATTREX_2013/rh/rh_omega_oct3.html.bakhttps://bocachica.arc.nasa.gov/ATTREX_2013/rh/rh_omega_sep30.html.bakhttps://bocachica.arc.nasa.gov/ATTREX_2014/attrex2014_satmap.html.bakhttps://bocachica.arc.nasa.gov/ATTREX_2014/schom/schomfigures_20140126.html.bakhttps://bocachica.arc.nasa.gov/ATTREX_2014/schom/schomfigures_20140226.html.bakhttps://bocachica.arc.nasa.gov/ATTREX_2014/trajfigures/trajfigures.html.bakhttps://bocachica.arc.nasa.gov/POSIDON/posidon.html.bakhttps://hesperia.gsfc.nasa.gov/hessi/solar_install/installation.bakhttps://ndeaa.jpl.nasa.gov/nasa-nde/outreach/outreach.html.bakhttps://ndeaa.jpl.nasa.gov/nasa-nde/yosi/yosi.htm.bak===================================================================Extension: old===================================================================https://bocachica.arc.nasa.gov/HAVE/nmc_rh_omega_plots.html.oldhttps://echo.jpl.nasa.gov/asteroids/1988TA/1988TA_planning.html.oldhttps://echo.jpl.nasa.gov/asteroids/1998QE2/1998QE2_planning.html.oldhttps://echo.jpl.nasa.gov/asteroids/2014JO25/2014JO25_planning.html.oldhttps://echo.jpl.nasa.gov/asteroids/goldstone_asteroid_schedule.html.oldhttps://fits.gsfc.nasa.gov/users_guide/users_guide.ps.oldhttps://image.msfc.nasa.gov/ChrisDocs/UDFInstall/uLibInstall.oldhttps://seawifs.gsfc.nasa.gov/OCEAN_PLANET/HTML/titanic.html.oldhttps://umbra.nascom.nasa.gov/soho/hga_history.html.oldhttps://www.nasa.gov/index.html.old

Lists files by extensions contained in a txt file.

> ./GooFuzz -t nasa.gov -e wordlists/extensions.txt -d 30********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.govTotal requests: 4===================================================================Extension: pdf===================================================================https://history.nasa.gov/alsj/a11/A11_PressKit.pdfhttps://history.nasa.gov/alsj/a13/A13_PressKit.pdfhttps://history.nasa.gov/alsj/a14/A14_PressKit.pdfhttps://history.nasa.gov/alsj/a15/A15_PressKit.pdfhttps://history.nasa.gov/alsj/a410/A09_PressKit.pdfhttps://oig.nasa.gov/NASA2011MajorChallenges.pdfhttps://solarsystem.nasa.gov/stardust/aerogel_factsheet.pdfhttps://www.hq.nasa.gov/alsj/LLRV_Monograph.pdf===================================================================Extension: xls===================================================================https://oig.nasa.gov/NASA_OIG_FY2013_Recovery_Act_Work_Plan.xlshttps://www.nasa.gov/xls/163559main_LunarExplorationObjectives.xlshttps://www.nasa.gov/xls/209970main_acr_section_c_icac_redacted_final_rev8_fixed.xlshttps://www.nasa.gov/xls/220716main_Ch2_6TV.xlshttps://www.nasa.gov/xls/279268main_Bird_Strikes.xlshttps://www.nasa.gov/xls/279283main_Collided_Nearly_Collided_With_Another_Aircraft_While_Both_on_Ground.xlshttps://www.nasa.gov/xls/279298main_Flight_Operations_Quality_Assurance_Program.xlshttps://www.nasa.gov/xls/279309main_Location_Aircraft_Unrequested_Clearance_Change.xlshttps://www.nasa.gov/xls/279532main_Runway_Taxiway_Excursions.xlshttps://www.nasa.gov/xls/279539main_Takeoffs_With_Out_of_Limit_Center_of_Gravity.xls===================================================================Extension: doc===================================================================https://cce.nasa.gov/te2010_ab_presentations/Breakout_report.dochttps://hdrl.gsfc.nasa.gov/LWS_Data_System_Final.dochttps://pumas.nasa.gov/files/01_06_14_1.dochttps://www.nasa.gov/279987main_0929MT.DOChttps://www.nasa.gov/88878main_C_PDP03.DOChttps://www.nasa.gov/doc/311200main_SELDP_Guideline_Rev_01262009.dochttps://www.nasa.gov/doc/378831main_Huntsville_Transcript_part5.doc===================================================================Extension: txt===================================================================https://aeronet.gsfc.nasa.gov/aeronet_locations.txthttps://atmcorr.gsfc.nasa.gov/actual_holdings.txthttps://fits.gsfc.nasa.gov/rfc4047.txthttps://leonid.arc.nasa.gov/02comment66.txthttps://leonid.arc.nasa.gov/99comment10.txthttps://leonid.arc.nasa.gov/comment36.txthttps://www.nasa.gov/190381main_Feldman-transcript.txthttps://www.nasa.gov/366950main_1.txthttps://www.nasa.gov/378571main_0728NASAMeeting.txthttps://www.nasa.gov/382774main_081209_DC_Transcript.txt

List files, directories and even parameters by means of a wordlist (it is recommended to use only very small files).

./GooFuzz -t nasa.gov -w wordlists/words-100.txt -p 3********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Directories and files found from: wordlists/words-100.txt===================================================================https://aeronet.gsfc.nasa.gov/cgi-bin/bamgomas_interactivehttps://aeronet.gsfc.nasa.gov/cgi-bin/draw_map_display_aod_v3https://aeronet.gsfc.nasa.gov/cgi-bin/webtool_aod_v3https://cdaweb.gsfc.nasa.gov/cgi-bin/eval2.cgihttps://heasarc.gsfc.nasa.gov/cgi-bin/tess/webtess/wtv.pyhttps://heasarc.gsfc.nasa.gov/cgi-bin/Tools/convcoord/convcoord.plhttps://heasarc.gsfc.nasa.gov/cgi-bin/Tools/w3nh/w3nh.plhttps://heasarc.gsfc.nasa.gov/cgi-bin/Tools/w3pimms/w3pimms.plhttps://heasarc.gsfc.nasa.gov/cgi-bin/Tools/xraybg...https://heasarc.gsfc.nasa.gov/cgi-bin/Tools/xraybg/xraybg.plhttps://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/swift.plhttps://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/w3browse.plhttps://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/w3catindex.plhttps://landweb.modaps.eosdis.nasa.gov/cgi-bin/QA_WWW/qaFlagPage.cgi?sathttps://landweb.modaps.eosdis.nasa.gov/cgi-bin/QA_WWW/qaFlagPage.cgi?sat=terrahttps://landweb.modaps.eosdis.nasa.gov/cgi-bin/QA_WWW/qaFlagPage.cgi?sat=terra%26ver=C6https://sscweb.gsfc.nasa.gov/cgi-bin/Locator.cgihttps://stereo.gsfc.nasa.gov/cgi-bin/imageshttps://stereo-ssc.nascom.nasa.gov/cgi-bin/imageshttps://svs.gsfc.nasa.gov/cgi-bin/details.cgi?aidhttps://svs.gsfc.nasa.gov/cgi-bin/details.cgi?aid=4285https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?searchhttps://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=10G004https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=11G020https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=11G032https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=12G008https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=12G028https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=13G019https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=14G009https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=19G014https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=20G024https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=22G012https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=9G023

Lists directories and files by specifying paths, words or file names.

> ./GooFuzz -t nasa.gov -w /login/,password,db.html -p 3********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Directories and files found from: /login/,password,db.html===================================================================https://femci.gsfc.nasa.gov/random/dB.htmlhttps://heasarc.gsfc.nasa.gov/ark/forgot/password.htmlhttps://osdr.nasa.gov/bio/submission-sso-login.htmlhttps://osdr.nasa.gov/bio/workspace-sso-login.htmlhttps://pubs.giss.nasa.gov/authors/db.htmlhttps://wwwastro.msfc.nasa.gov/qdp/lextrct/db.htmlhttps://www-mipl.jpl.nasa.gov/vicar/core460/html/javadoc/index.html?jpl/mipl/jujube/servlet/Login.htmlhttps://www-mipl.jpl.nasa.gov/vicar/core460/html/javadoc/index.html?jpl/mipl/mdms/FileService/komodo/services/query/server/Login.htmlhttps://www-mipl.jpl.nasa.gov/vicar/core460/html/javadoc/jpl/mipl/mdms/FileService/komodo/services/query/server/Login.htmlhttps://www-mipl.jpl.nasa.gov/vicar/core470/html/javadoc/index.html?jpl/mipl/jujube/servlet/Login.htmlhttps://www-mipl.jpl.nasa.gov/vicar/core470/html/javadoc/index.html?jpl/mipl/mdms/FileService/komodo/services/query/server/Login.htmlhttps://www-mipl.jpl.nasa.gov/vicar/core470/html/javadoc/jpl/mipl/jujube/servlet/Login.htmlhttps://www-mipl.jpl.nasa.gov/vicar/core470/html/javadoc/jpl/mipl/mdms/FileService/komodo/services/query/server/Login.html

Exclusion of subdomains in your searches (separated by commas or by a list)

Example 1:

> ./GooFuzz -t nasa.gov -w login -p 1********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Directories and files found from: login===================================================================https://daac.gsfc.nasa.gov/loginhttps://disc.gsfc.nasa.gov/earthdata-loginhttps://disc.gsfc.nasa.gov/images/login1.pnghttps://disc.gsfc.nasa.gov/images/login4.pnghttps://disc.gsfc.nasa.gov/images/login5.pnghttps://disc.gsfc.nasa.gov/images/login6.pnghttps://invention.nasa.gov/prog/loginhttps://kauai.ccmc.gsfc.nasa.gov/DONKI/loginhttps://ladsweb.modaps.eosdis.nasa.gov/oauth/loginhttps://software.nasa.gov/loginhttps://stemgateway.nasa.gov/public/s/login/https://technology.nasa.gov/loginhttps://wiki.earthdata.nasa.gov/display/EL/Howhttps://wiki.earthdata.nasa.gov/download/attachments/109874707/home _register.png?versionhttps://wiki.earthdata.nasa.gov/download/attachments/109874707/registration2.png?versionhttps://wiki.earthdata.nasa.gov/login.actionhttps://www.earthdata.nasa.gov/eosdis/science-system-description/eosdis-components/earthdata-loginhttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_1.jpghttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_2.jpghttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_4.jpghttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_5.jpghttps://www.jpl.nasa.gov/site/NSET/accounts/login/                                                                                                                                         > ./GooFuzz -t nasa.gov -w login -p 1 -x wiki.earthdata.nasa.gov********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Directories and files found from: login===================================================================https://daac.gsfc.nasa.gov/loginhttps://disc.gsfc.nasa.gov/earthdata-loginhttps://disc.gsfc.nasa.gov/images/login1.pnghttps://disc.gsfc.nasa.gov/images/login4.pnghttps://disc.gsfc.nasa.gov/images/login5.pnghttps://disc.gsfc.nasa.gov/images/login6.pnghttps://invention.nasa.gov/assets/images/banner-meatball.pnghttps://invention.nasa.gov/prog/loginhttps://ladsweb.modaps.eosdis.nasa.gov/loginhttps://ladsweb.modaps.eosdis.nasa.gov/oauth/loginhttps://software.nasa.gov/loginhttps://stemgateway.nasa.gov/public/s/login/https://technology.nasa.gov/loginhttps://www.earthdata.nasa.gov/eosdis/science-system-description/eosdis-components/earthdata-loginhttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_1.jpghttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_2.jpghttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_3.jpghttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_4.jpghttps://www.earthdata.nasa.gov/sites/default/files/imported/EDL_5.jpg

Example 2:

> cat exclusion-list.txtdaac.gsfc.nasa.govinvention.nasa.govsoftware.nasa.gov                                                                                                                                         > ./GooFuzz -t nasa.gov -w login -p 1 -x exclusion-list.txt********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Directories and files found from: login===================================================================https://disc.gsfc.nasa.gov/earthdata-loginhttps://ladsweb.modaps.eosdis.nasa.gov/oauth/loginhttps://nightsky.jpl.nasa.gov/login.cfmhttps://podaac-tools.jpl.nasa.gov/drive/login?actionhttps://podaac-tools.jpl.nasa.gov/drive/login?action=loginhttps://stemgateway.nasa.gov/public/s/login/https://technology.nasa.gov/loginhttps://wiki.earthdata.nasa.gov/login.actionhttps://www.earthdata.nasa.gov/eosdis/science-system-description/eosdis-components/earthdata-loginhttps://www.jpl.nasa.gov/site/NSET/accounts/login/https://www.sewp.nasa.gov/qrt/security/login.sa

Subdomains enumeration

> ./GooFuzz -t nasa.gov -s -p 20********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Subdomains found:===================================================================http://go.nasa.govhttps://aeronet.gsfc.nasa.govhttps://airs.jpl.nasa.govhttps://api.nasa.govhttps://apod.nasa.govhttps://appel.nasa.govhttps://ares.jsc.nasa.govhttps://asterweb.jpl.nasa.govhttps://astrobiology.nasa.govhttps://blogs.nasa.govhttps://ceres.larc.nasa.govhttps://climatekids.nasa.govhttps://climate.nasa.govhttps://cneos.jpl.nasa.govhttps://data.nasa.govhttps://earthobservatory.nasa.govhttps://europa.nasa.govhttps://exoplanets.nasa.govhttps://eyes.nasa.govhttps://firms.modaps.eosdis.nasa.govhttps://go.nasa.govhttps://imagine.gsfc.nasa.govhttps://intern.nasa.govhttps://lambda.gsfc.nasa.govhttps://mars.nasa.govhttps://missionstem.nasa.govhttps://mms.gsfc.nasa.govhttps://modis.gsfc.nasa.govhttps://ntrs.nasa.govhttps://power.larc.nasa.govhttps://science.gsfc.nasa.govhttps://science.nasa.govhttps://sdo.gsfc.nasa.govhttps://search.earthdata.nasa.govhttps://smap.jpl.nasa.govhttps://software.nasa.govhttps://solarsystem.nasa.govhttps://spaceplace.nasa.govhttps://spotthestation.nasa.govhttps://swot.jpl.nasa.govhttps://terra.nasa.govhttps://webb.nasa.govhttps://worldview.earthdata.nasa.govhttps://worldwind.arc.nasa.govhttps://www1.grc.nasa.govhttps://www.earthdata.nasa.govhttps://www.giss.nasa.govhttps://www.jpl.nasa.govhttps://www.sewp.nasa.govhttps://www.sti.nasa.gov

Files found containing enumeration

> ./GooFuzz -t nasa.gov -c password********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: nasa.gov===================================================================Files found containing: password===================================================================https://cdaweb.gsfc.nasa.gov/WebServices/REST/idl/api/idldoc-index.htmlhttps://cdaweb.gsfc.nasa.gov/WebServices/REST/idl/public/idldoc-index.htmlhttps://cloud1.arc.nasa.gov/sonex/pages/sonex_data_exchg.htmlhttps://essp.larc.nasa.gov/EVM-3/pdf_files/N_PR_2200_002D_.pdfhttps://heasarc.gsfc.nasa.gov/docs/software/ftools/fv/doc/fileSelection.htmlhttps://hera.gsfc.nasa.gov/webHera/doc/webHera_1.fld/image004.pnghttps://hera.gsfc.nasa.gov/webHera/doc/webHera_1.fld/image029.pnghttps://hera.gsfc.nasa.gov/webHera/doc/webHera_1.fld/image068.pnghttps://hera.gsfc.nasa.gov/webHera/doc/webHera_1.htmlhttps://modis-land.gsfc.nasa.gov/pdf/MODIS_C6_BA_User_Guide_1.0.pdfhttps://nodis3.gsfc.nasa.gov/NPD_attachments/Purchase.pdfhttps://nodis3.gsfc.nasa.gov/NPR_attachments/NRRS_1441.1.pdfhttps://ntrs.nasa.gov/api/citations/19960050121/downloads/19960050121.pdfhttps://procurement.ksc.nasa.gov/-/media/NPSC-SR/BiddersLibrary/DocumentLibrary/NRRS 14411 NASA Record Retention Schedules.ashxhttps://science.nasa.gov/files/atoms/files/Published HPAC FRN May 5-6 Meetinghttps://science.nasa.gov/files/atoms/files/Published HPAC FRN May 5-6 Meeting%5B1%5D.pdfhttps://www-air.larc.nasa.gov/pub/PEMTROPICSB/MODELING/KRISHNAMURTI.FSU/README.txthttps://www-mipl.jpl.nasa.gov/Dbms/dbi/html/MDMS__DBI__Password_8h.htmlhttps://www-mipl.jpl.nasa.gov/Dbms/dbi/html/MDMS__DBI__Password_8h__incl.gifhttps://www.nas.nasa.gov/hecc/support/kb/pdf-cat/157/https://www.nccs.nasa.gov/images/Intel_MPI_Reference_Manual.pdf

Proof of concept with an image

> ./GooFuzz -t .com -c changeme -e pdf********************************************************** GooFuzz 1.2.2 - The Power of Google Dorks             **********************************************************Target: .com===================================================================Extension: pdfFiles found containing: changeme===================================================================https://docs.itrsgroup.com/docs/geneos/4.4.0/SSO Agent/Geneos SSO User Guide v1.0.0.pdfhttps://docs.oracle.com/cd/B31589_01/gc3/pdf/integration/gc3datamanagement.pdfhttps://docs.vmware.com/en/VMware-Smart-Assurance/10.1.5/sm-pub-smarts-security-config-guide-1015.pdfhttps://qsupport.quantum.com/kb/flare/Content/QEKM/Downloads/6-01847-02_Q-EKM_UsersGuide.pdfhttps://www.cisco.com/c/en/us/td/docs/net_mgmt/broadband_access_center/3-6/administration/guide/admbac36/chap_20.pdfhttps://www.delltechnologies.com/asset/en-us/products/data-protection/technical-support/docu96471.pdfhttps://www.delltechnologies.com/asset/en-us/products/data-protection/technical-support/docu97051.pdfhttps://www.delltechnologies.com/content/dam/digitalassets/active/en/unauth/technical-guides-support-information/products/data-protection/docu97051.pdfhttps://www.delltechnologies.com/content/dam/digitalassets/active/en/unauth/technical-guides-support-information/products/data-protection/docu97085.pdf

Proof of concept with an PDF file

Disclaimer

Useful?