GHDB :: Files containing passwords
| Date | Title | Summary | |
| 2003-06-24 | mysql history files | The .mysql_history file contains commands that were performed against a mysql database. A "history" of said commands. First, you shouldn … |
 |
| 2003-06-24 | intitle:index.of intext:"secring .skr"|&q… |
PGP is a great encryption technology. It keeps secrets safe. Everyone from drug lords to the head of the DEA can download PGP to encrypt their sensiti … |
|
| 2003-06-24 | people.lst | *sigh* … | |
| 2003-06-24 | passwd | There's nothing that defines a googleDork more than getting your PASSWORDS grabbed by Google for the world to see. Truly the epitome of a googleD … |
|
| 2003-06-24 | master.passwd | There's nothing that defines a googleDork more than getting your PASSWORDS grabbed by Google for the world to see. Truly the epitome of a googleD … |
|
| 2003-06-24 | pwd.db | There's nothing that defines a googleDork more than getting your PASSWORDS grabbed by Google for the world to see. Truly the epitome of a googleD … |
|
| 2003-06-24 | htpasswd / htpasswd.bak |
There's nothing that defines a googleDork more than getting your PASSWORDS grabbed by Google for the world to see. Truly the epitome of a googleD … |
|
| 2003-06-24 | htpasswd / htgroup | There's nothing that defines a googleDork more than getting your PASSWORDS grabbed by Google for the world to see. Truly the epitome of a googleD … |
|
| 2003-06-24 | spwd.db / passwd | There's nothing that defines a googleDork more than getting your PASSWORDS grabbed by Google for the world to see. Truly the epitome of a googleD … |
|
| 2003-06-24 | passwd / etc (reliable) |
There's nothing that defines a googleDork more than getting your PASSWORDS grabbed by Google for the world to see. Truly the epitome of a googleD … |
|
| 2003-06-24 | config.php | This search brings up sites with "config.php" files. To skip the technical discussion, this configuration file contains both a username and … |
|
| 2003-06-27 | passlist | I'm not sure what uses this, but the passlist and passlist.txt files contain passwords in CLEARTEXT! That's right, no decoding/decrypting/en … |
|
| 2003-06-27 | etc (index.of) | This search gets you access to the etc directory, where many many many types of password files can be found. This link is not as reliable, but crawlin … |
|
| 2003-06-30 | filetype:xls username password |
This search shows Microsoft Excel spreadsheets containing the words username, password and email. Beware that there are a ton of blank "template& … |
|
| 2003-07-11 | auth_user_file.txt | DCForum's password file. This file gives a list of (crackable) passwords, usernames and email addresses for DCForum and for DCShop (a shopping ca … |
|
| 2003-07-29 | inurl:config.php dbuname dbpass |
The old config.php script. This puppy should be held very closely. It should never be viewable to your web visitors because it contains CLEARTEXT user … |
|
| 2003-08-19 | trillian.ini | Trillian pulls together all sort of messaging clients like AIM MSN, Yahoo, IRC, ICQ, etc. The various ini files that trillian uses include files like … |
|
| 2004-01-23 | passlist.txt (a better way) |
Cleartext passwords. No decryption required! … |
|
| 2004-03-04 | htpasswd | This is a nifty way to find htpasswd files. Htpasswd files contain usernames and crackable passwords for web pages and directories. They're suppo … |
|
| 2004-03-04 | intitle:index.of administrators.pwd |
This file contains administrative user names and (weakly) encrypted password for Microsoft Front Page. The file should not be readble to the general p … |
|
| 2004-03-04 | inurl:secring ext:skr | ext:pgp | ext:bak |
This file is the secret keyring for PGP encryption. Armed with this file (and perhaps a passphrase), a malicious user can read all your encrypted file … |
|
| 2004-03-04 | intitle:Index.of etc shadow |
This file contains usernames and (lame) encrypted passwords! Armed with this file and a decent password cracker, an attacker can crack passwords and l … |
|
| 2004-04-16 | allinurl: admin mdb | Not all of these pages are administrator's access databases containing usernames, passwords and other sensitive information, but many are! … |
|
| 2004-04-19 | filetype:cfm "cfapplication name" passwo… |
These files contain ColdFusion source code. In some cases, the pages are examples that are found in discussion forums. However, in many cases these pa … |
|
| 2004-04-26 | eggdrop filetype:user user |
These are eggdrop config files. Avoiding a full-blown descussion about eggdrops and IRC bots, suffice it to say that this file contains usernames and … |
|
| 2004-04-26 | intitle:"index of" intext:connect.inc |
These files often contain usernames and passwords for connection to mysql databases. In many cases, the passwords are not encoded or encrypted. … |
|
| 2004-05-03 | inurl:perform filetype:ini |
Displays the perform.ini file used by the popular irc client mIRC. Often times has channel passwords and/or login passwords for nickserv. … |
|
| 2004-05-03 | intitle:"index of" intext:globals.inc |
contains plaintext user/pass for mysql database … |
|
| 2004-05-04 | filetype:properties inurl:db intext:password |
The db.properties file contains usernames, decrypted passwords and even hostnames and ip addresses of database servers. This is VERY severe, earning t … |
|
| 2004-05-05 | filetype:inc intext:mysql_connect |
INC files have PHP code within them that contain unencrypted usernames, passwords, and addresses for the corresponding databases. Very dangerous stuf … |
|
| 2004-05-07 | filetype:reg reg +intext:"defaul tusername&quo… |
These pages display windows registry keys which reveal passwords and/or usernames. … |
|
| 2004-05-11 | filetype:reg reg HKEY_CURRENT_USER SSHHOSTKEYS |
This search reveals SSH host key fro the Windows Registry. These files contain information about where the user connects including hostnames and port … |
|
| 2004-05-12 | inurl:vtund.conf intext:pass -cvs |
Theses are vtund configuration files (http://vtun.sourceforge.net). Vtund is an encrypted tunneling program. The conf file holds plaintext passwords. … |
|
| 2004-05-12 | filetype:url +inurl:"ftp://& quot; +inurl:&qu… |
These are FTP Bookmarks, some of which contain plaintext login names and passwords. … |
|
| 2004-05-13 | filetype:log inurl:"password .log" |
These files contain cleartext usernames and passwords, as well as the sites associated with those credentials. Attackers can use this information to l … |
|
| 2004-05-17 | filetype:dat "password.dat&q uot; |
This file contains plaintext usernames and password. Deadly information in the hands of an attacker. … |
|
| 2004-05-17 | filetype:conf slapd.conf |
slapd.conf is the file that contains all the configuration for OpenLDAP, including the root password, all in clear text. Other useful information that … |
|
| 2004-05-17 | filetype:pem intext:private |
This search will find private key files… Private key files are supposed to be, well… private. … |
|
| 2004-05-24 | inurl:"wvdial.c onf" intext:"passwor … |
The wvdial.conf is used for dialup connections.it contains phone numbers, usernames and passwords in cleartext. … |
|
| 2004-05-26 | filetype:inc dbconn | This file contains the username and password the website uses to connect to the db. Lots of these Google results don't take you straight to … |
|
| 2004-05-25 | inurl:"slapd.co nf" intext:"credent i… |
slapd.conf is the configuration file for slapd, the opensource LDAP deamon. The key "credentinals" contains passwords in cleartext. … |
|
| 2004-05-25 | inurl:"slapd.co nf" intext:"rootpw& q… |
slapd.conf is the configuration file for slapd, the opensource LDAP deamon. You can view a cleartext or crypted password for the "rootdn". … |
|
| 2004-05-26 | filetype:ini ws_ftp pwd |
The encryption method used in WS_FTP is _extremely_ weak. These files can be found with the "index of" keyword or by searching directly for … |
|
| 2004-05-26 | filetype:netrc password |
The .netrc file is used for automatic login to servers. The passwords are stored in cleartext. … |
|
| 2004-05-26 | signin filetype:url | Javascript for user validation is a bad idea as it shows cleartext user/pass combos. There is one googledork who forgot that. … |
|
| 2004-05-27 | filetype:dat wand.dat |
The world-famous web-browser Opera has the ability to save the password for you, and it call the system "Magic Wand". When on a site, you ca … |
|
| 2004-06-02 | filetype:ldb admin | According to filext.com, the ldb file is "A lock file is used to keep muti-user databases from being changed in the same place by two people at t … |
|
| 2004-06-02 | filetype:cfg mrtg "target[*]" ; -sample -c… |
Mrtg.cfg is the configuration file for polling SNMP enabled devices. The community string (often 'public') is found in the line starting wit … |
|
| 2004-06-04 | filetype:sql +"IDENTIFIED BY" -cvs |
Database maintenance is often automated by use of .sql files wich may contain many lines of batched SQL commands. These files are often used to create … |
|
| 2004-06-04 | filetype:sql password |
Database maintenance is often automated by use of .sql files that contain many lines of batched SQL commands. These files are often used to create dat … |
|
| 2004-06-10 | filetype:pwd service | Microsoft Frontpage extensions appear on virtually every type of scanner. In the late 90's people thought they where hardcore by defacing sites w … |
|
| 2004-06-10 | inurl:zebra.conf intext:password -sample -test -tu… |
GNU Zebra is free software that manages TCP/IP based routing protocols. It supports BGP-4 protocol as well as RIPv1, RIPv2 and OSPFv2.The zebra.conf … |
|
| 2004-06-10 | inurl:ospfd.conf intext:password -sample -test -tu… |
GNU Zebra is free software that manages TCP/IP based routing protocols. It supports BGP-4 protocol as well as RIPv1, RIPv2 and OSPFv2.The ospfd.conf u … |
|
| 2004-06-18 | inurl:ccbill filetype:log |
CCBill.com sells E-tickets to online entertainment and subscription-based websites. CCBill.com gives consumers access to the hottest entertainment sit … |
|
| 2004-06-16 | filetype:mdb inurl:users.mdb |
Everyone has this problem, we need to remember many passwords to access the resources we use. Some believe it is a good solution to use Microsoft Acce … |
|
| 2004-07-06 | psyBNC config files | psyBNC is an IRC-Bouncer with many features. It compiles on Linux, FreeBSD, SunOs and Solaris. The configuration file for psyBNC is called psybnc.conf … |
|
| 2004-07-12 | NickServ registration passwords |
NickServ allows you to "register" a nickname (on some IRC networks) and prevent others from using it. Some channels also require you to use … |
|
| 2004-07-16 | inurl:lilo.conf filetype:conf password -tatercount… |
LILO is a general purpose boot manager that can be used to boot multiple operating systems, including Linux. The normal configuration file is located … |
|
| 2004-07-16 | intitle:"Index of" passwords modified |
These directories are named "password." I wonder what you might find in here. Warning: sometimes p0rn sites make directories on servers with … |
|
| 2004-07-19 | "sets mode: +k" |
This search reveals channel keys (passwords) on IRC as revealed from IRC chat logs. … |
|
| 2004-07-26 | "# -FrontPage-" ext:pwd inurl:(service |… |
Frontpage.. very nice clean search results listing !!No further comments required..changelog:22 jan 2005: improved by vs1400 ! … |
|
| 2004-07-29 | filetype:pwl pwl | These are Windows Password List files and have been known to be easy to crack since the release of Windows 95. An attacker can use the PWLTools to dec … |
|
| 2004-08-01 | inurl:/wwwboard | The software wwwboard stores its passwords in a file called "passwd.txt".An attacker may try to search forinurl:/wwwboardthen add a "pa … |
|
| 2004-08-05 | "AutoCreate=TRU E password=*" |
This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. For those who can read Japanese, c … |
|
| 2004-08-06 | filetype:pass pass intext:userid |
Generally, these are dbman password files. They are not cleartext, but still allow an attacker to harvest usernames and optionally crack passwords off … |
|
| 2004-08-06 | filetype:ini ServUDaemon |
The servU FTP Daemon ini file contains setting and session information including usernames, passwords and more. … |
|
| 2004-08-10 | inurl:nuke filetype:sql |
This search reveals database dumps that most likely relate to the php-nuke or postnuke content management systems. These database dumps contain userna … |
|
| 2004-08-13 | inurl:/db/main.mdb | ASP-Nuke database file containing passwords.This search goes for the direct location and has few results. For more hits an attacker would try to find … |
|
| 2004-08-14 | "http://*:*@www " domainname |
This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the the domain name without th … |
|
| 2004-08-14 | filetype:bak inurl:"htaccess |passwd|shadow|ht… |
This will search for backup files (*.bak) created by some editors or even by the administrator himself (before activating a new version). Every attack … |
|
| 2004-08-16 | filetype:conf oekakibbs |
Oekakibss is a japanese anime creation application. The config file tells an attacker the encrypted password. … |
|
| 2004-08-20 | LeapFTP intitle:"index. of./" sites.ini m… |
The LeapFTP client configuration file "sites.ini" holds the login credentials for those sites in plain text. The passwords seems to be encry … |
|
| 2004-08-25 | filetype:ini wcx_ftp | This searches for Total commander FTP passwords (encrypted) in a file called wcx_ftp.ini. Only 6 hits at the moment, but there may be more in the futu … |
|
| 2004-09-16 | filetype:config config intext:appSettings "Us… |
These files generally contain configuration information for a .Net Web Application. Things like connection strings to databases file directories and m … |
|
| 2004-09-17 | "index of/" "ws_ftp.ini&quo t; "… |
This search is a cleanup of a previous entry by J0hnny. It uses "parent directory" to avoid results other than directory listings.WS_FTP.ini … |
|
| 2004-09-24 | filetype:mdb wwforum | Web Wiz Forums is a free ASP Bulletin Board software package. It uses a Microsoft Access database for storage. The installation instructions clearly i … |
|
| 2004-09-24 | "Powered By Elite Forum Version *.*" |
Elite forums is one of those Microsoft Access .mdb file based forums. This one is particularly dangerous, because the filename and path are hardcoded … |
|
| 2004-10-10 | filetype:ini inurl:flashFXP.ini |
FlashFXP offers the easiest and fastest way to transfer any file using FTP, providing an exceptionally stable and robust program that you can always c … |
|
| 2004-11-06 | inurl:chap-secrets -cvs |
linux vpns store their usernames and passwords for CHAP authentification in a file called "chap-secrets" where the usernames and the passwor … |
|
| 2004-11-06 | inurl:pap-secrets -cvs |
linux vpns store there usernames and passwords for PAP authentification in a file called "pap-secrets" where the usernames and the passwords … |
|
| 2004-11-06 | filetype:ini inurl:"serv-u.i ni" |
serv-U is a ftp/administration server for Windows. This file leaks info about the version, username and password. Passwords are in encrypted, but ther … |
|
| 2004-11-08 | "liveice configuration file" ext:cfg -si… |
This finds the liveice.cfg file which contains all configuration data for an Icecast server. Passwords are saved unencrypted in this file. … |
|
| 2004-11-16 | intext:"enable secret 5 $" |
sometimes people make mistakes and post their cisco configs on "help sites" and don't edit the sensitive fields first. Don't forge … |
|
| 2004-11-23 | "Powered by Dudirectory" -site:duware.co… |
Most duware products use Microsoft Access databases in default locations without instructing the users to change them. The plain text admin passwords … |
|
| 2004-11-23 | "powered by ducalendar" -site:duware.com |
Most duware products use Microsoft Access databases in default locations without instructing the users to change them. The plain text admin passwords … |
|
| 2004-11-23 | "Powered by Duclassified" -site:duware.c… |
Most duware products use Microsoft Access databases in default locations without instructing the users to change them. The plain text admin passwords … |
|
| 2004-11-23 | "Powered by Duclassified" -site:duware.c… |
Most duware products use Microsoft Access databases in default locations without instructing the users to change them. The plain text admin passwords … |
|
| 2004-11-23 | "powered by duclassmate" -site:duware.co… |
Most duware products use Microsoft Access databases in default locations without instructing the users to change them. The plain text admin passwords … |
|
| 2004-11-23 | intitle:dupics inurl:(add.asp | default.asp | view… |
Most duware products use Microsoft Access databases in default locations without instructing the users to change them. The plain text admin passwords … |
|
| 2004-11-23 | "powered by dudownload" -site:duware.com |
Most duware products use Microsoft Access databases in default locations without instructing the users to change them. The plain text admin passwords … |
|
| 2004-11-28 | filetype:log "See `ipsec –copyright" |
BARF log filesMan page:Barf outputs (on standard output) a collection of debugging information (contents of files, selections from logs, etc.) related … |
|
| 2004-11-28 | inurl:"GRC.DAT& quot; intext:"passwor d&qu… |
symantec Norton Anti-Virus Corporate Edition data file containing encrypted passwords. … |
|
| 2004-12-02 | inurl:filezilla.xml -cvs |
filezilla.xml contains Sites,Logins and crypted Passwords of ftp connections made with the open source programm filezilla. … |
|
| 2004-12-13 | intext:"powered by Web Wiz Journal" |
Web Wiz Journal ASP Blog. The MDB database is mostly unprotected and can be downloaded directly. The DB contains administrative acccountsfilename: jou … |
|
| 2004-12-19 | ext:ini eudora.ini | Well, this is the configuration file for Eudora…may contain sensitive information like pop servers, logins and encypted passwords sometimes. … |
|
| 2005-01-27 | ext:ini Version=4.0.0.4 password |
The servU FTP Daemon ini file contains setting and session information including usernames, passwords and more. This is a more specific search for Ser … |
|
| 2005-02-09 | filetype:inc mysql_connect OR mysql_pconnect |
INC files have PHP code within them that contain unencrypted usernames, passwords, and addresses for the corresponding databases. Very dangerous stuf … |
|
| 2005-02-07 | "Powered by DUpaypal" -site:duwa… |
Here is another DUware product, DUpaypal. Once you get hold of the database it contains the admin username and password. The default by the way is adm … |
|
| 2005-02-15 | "Powered by Link Department" |
Link management script with advanced yet easy to use admin control panel, fully template driven appearance, static HTML front-end and email notificati … |
|
| 2005-02-10 | intitle:"Index of" sc_serv.conf sc_serv … |
This dork lists sc_serv.conf files. These files contain information for Shoutcast servers and often contain cleartext passwords.Original dork: filetyp … |
|
| 2005-02-23 | filetype:sql ("values * MD5" | "val… |
Locate insert statements making use of some builtin function to encrypt a password. PASSWORD(), ENCRYPT() and MD5() are searched. … |
|
| 2005-02-23 | filetype:sql ("passwd values" | … |
Find insert statements where the field (or table name) preceding the operator VALUES will be 'password' or 'passwd' or 'pass … |
|
| 2005-03-20 | ext:txt inurl:unattend.txt |
the unattend.txt is used to drive unanttended MS Windows installations. The files contain all information for a Windows information including Administ … |
|
| 2005-03-20 | filetype:inf sysprep | sysprep is used to drive unanttended MS Windows installations. The files contain all information for a Windows information including Administrator … |
|
| 2005-03-28 | wwwboard WebAdmin inurl:passwd.txt wwwboard|webad… |
This is a filtered version of previous 'inurl:passwd' searches, focusing on WWWBoard [1]. There are different crypt functions involved [2], … |
|
| 2005-05-02 | !Host=*.* intext:enc_UserPassw ord=* ext:pcf |
some people actually keep their VPN profiles on the internet…omg… Simply donwload the pcf file, import it in your Cisco VPN client and try to conn … |
|
| 2005-05-06 | inurl:server.cfg rcon password |
Counter strike rcon passwords, saved in the server.cfg. … |
|
| 2005-05-11 | intext:"powered by EZGuestbook" |
HTMLJunction EZGuestbook is prone to a database disclosure vulnerability. Remote users may download the database http://www.securityfocus.com/bid/1354 … |
|
| 2005-06-06 | inurl:perform.ini filetype:ini |
mIRC Passwords For Nicks & Channels in channel\[chanfolder] section of mirc.ini you can find 2 type of "private" information – secret ch … |
|
| 2005-06-04 | inurl:pass.dat | Accesses passwords mostly in cgibin but not all the timeCan find passwords + usernames (sometimes username), some unecrypted some not … |
|
| 2005-06-05 | intitle:"phpinf o()" +"mysql.default … |
This will look throught default phpinfo pages for ones that have a default mysql password. … |
|
| 2005-06-24 | inurl:cgi-bin inurl:calendar.cfg |
CGI Calendar (Perl) configuration file reveals information including passwords for the program. … |
|
| 2005-07-27 | [WFClient] Password= filetype:ica |
The WinFrame-Client infos needed by users to connect toCitrix Application Servers (e.g. Metaframe).Often linked/stored on Webservers and sometimes rea … |
|
| 2005-08-31 | ext:inc "pwd=" "UID=" |
Database connection strings including passwords … |
|
| 2005-09-13 | filetype:dat inurl:Sites.dat |
If you want to find out FTP passwords from FlashFXP Client, just type this query in google and you'll find files called Sites.dat which contain f … |
|
| 2005-09-13 | intext:"enable password 7" |
some people are that stupid to keep their Cisco routers config files on site. You can easly find out configs and password alog with IP addresses of th … |
|
| 2005-09-18 | intitle:rapidshare intext:login |
Rapidshare login passwords. … | |
| 2005-09-24 | "your password is" filetype:log |
This search finds log files containing the phrase (Your password is). These files often contain plaintext passwords, although YMMV. … |
|
| 2005-09-25 | "admin account info" filetype:log |
searches for logs containing admin server account information such as username and password. … |
|
| 2005-09-28 | inurl:/yabb/Members/ Admin.dat |
This search will show you the Administrator password (very first line) on YaBB forums whose owners didnt configure the permissions correctly. Go up a … |
|
| 2005-10-30 | server-dbs "intitle:index of" |
Yes, people actually post their teamspeak servers on websites. Just look for the words superadmin in the files and the password trails it in plain tex … |
|
| 2005-11-03 | inurl:"Sites.da t"+"PASS=& quot; |
FlashFXP has the ability to import a Sites.dat file into its current Sites.dat file, using this search query you are able to find websites misconfigur … |
|
| 2005-11-14 | ext:yml database inurl:config |
Ruby on Rails is a MVC full-stack framework for development of web applications. There's a configuration file in this framework called database.y … |
|
| 2005-11-30 | "parent directory" +proftpdpasswd |
User names and password hashes from web server backups generated by cpanel for ProFTPd. Password hashes can be cracked, granting direct access to FTP … |
|
| 2005-12-19 | inurl:ventrilo_srv.i ni adminpassword |
This search reveals the ventrilo (voice communication program used by many online gamers) passwords for many servers. Possiblity of gaining control of … |
|
| 2006-01-01 | filetype:bak createobject sa |
This query searches for files that have been renamed to a .bak extension (obviously), but includes a search for the characters "sa" (default … |
|
| 2006-01-02 | inurl:"editor/l ist.asp" | inurl:"da… |
This search finds CLEARTEXT usernames/passwords for the Results Database Editor. The log in portal can be found at /editor/login.asp. At time of sub … |
|
| 2006-01-02 | ext:passwd -intext:the -sample -example |
Various encrypted passwords, some plaintext passwords and some private keys are revealed by this search. … |
|
| 2006-01-02 | enable password | secret "current configurati… |
Another Cisco configuration search. This one is cleaner, gives complete configuration files and it catches plaintext, "secret 5" and "p … |
|
| 2006-01-02 | ext:asa | ext:bak intext:uid intext:pwd -"uid… |
search for plaintext database credentials in ASA and BAK files. … |
|
| 2006-02-05 | filetype:reg reg +intext:Ã&Ac irc;¢&At… |
This can be used to get encoded vnc passwords which can otherwise be obtained by a local registry and decoded by cain & abel. The query find regis … |
|
| 2006-03-06 | filetype:sql "insert into" (pass|passwd|… |
Looks for SQL dumps containing cleartext or encrypted passwords. … |
|
| 2006-03-21 | inurl:"calendar script/users.txt&quo t; |
CalenderScript is an overpriced online calender system written in perl. The passwords are encrypted using perl's crypt() function which I think D … |
|
| 2006-08-10 | ext:php intext:"$dbms&q uot;"$dbhost&qu ot… |
Hacking a phpBB forum. Here you can gather the mySQL connection information for their forum database. View the .php info by using Google's cache … |
|
| 2006-09-06 | "login: *" "password: *" filet… |
This returns xls files containing login names and passwords. it works by showing all the xls files with password:(something)so a downside is that u do … |
|
