312-50 Question 27
Single answer▪ Footprinting through Search EnginesDuring an authorized reconnaissance phase, a security consultant is asked to identify whether a company has unintentionally exposed internal documents through public search engine indexing. The consultant wants a search query that is most likely to reveal sensitive files such as spreadsheets or PDFs hosted on the target's own domain, while minimizing unrelated results from other websites. Which query is the BEST choice?
- A
site:example.com filetype:pdf OR filetype:xls OR filetype:xlsx
- B
inurl:admin example.com confidential files
- C
related:example.com ext:pdf
- D
cache:example.com filetype:doc
Show answer and explanation
Correct answer: A
Explanation
For footprinting through search engines, the most effective approach is to combine operators that both constrain scope and target likely data types. In this scenario, site:example.com limits results to the organization's domain, while filetype:pdf, filetype:xls, and filetype:xlsx focus on document formats that often contain business-sensitive information. This aligns with common reconnaissance techniques covered in CEH, often referred to as Google hacking or Google dorking. Operators such as site:, filetype:, intitle:, and inurl: are useful when applied correctly, but operators like related: and cache: serve different purposes and are less suitable for finding exposed documents. Google Search operator guidance and well-established reconnaissance best practices support using domain-restricted file searches to identify publicly indexed resources during authorized assessments.
- A. Correct.
Correct. The query uses the site: operator to restrict results to the target domain and combines filetype filters to locate indexed document formats commonly associated with sensitive business data. This is a practical Google dorking technique for footprinting because it narrows results to public files hosted by the organization rather than general references to the organization elsewhere on the Internet.
- B. Incorrect.
Incorrect. Although inurl:admin may return pages containing 'admin' in the URL, adding plain terms like 'example.com confidential files' does not reliably restrict results to the target domain. This query is also poorly structured for finding exposed documents and may produce noisy, irrelevant results. A candidate might choose it because 'admin' sounds sensitive, but it is not the best query for discovering indexed files on the organization's domain.
- C. Incorrect.
Incorrect. The related: operator is intended to find websites similar to a specified site, not documents hosted by that site. While ext:pdf is sometimes seen in searches, filetype: is the more standard and reliable operator for this use case. This option reflects a common misconception that any search operator combination can be used to enumerate exposed files on a target domain.
- D. Incorrect.
Incorrect. The cache: operator displays Google's cached version of a page for a specific URL or domain-related result and is not intended for broad document discovery. Combining cache:example.com with filetype:doc does not effectively enumerate indexed documents on the target site. Someone might pick this option because cached pages can reveal old content, but it is not the best method for this stated objective.