🗑️ Carding/Hacking Bites: Digital Dumpster Diving with Google Dorks 🗑️

d0ctrine · Aug 5, 2024

Carding/Hacking Bites: Digital Dumpster Diving with Google Dorks

Look, I get it. Youre here to become a top-tier carder, not waste your time sifting through digital trash. But heres the thing: sometimes, that trash can be pure gold. Welcome to the world of digital dumpster diving, where dorks are your flashlight in the dark.

Now, Im not saying you should spend all day hunched over your keyboard, eyes bleeding from endless search results. Thats a rookies game. But having this skill in your back pocket? That will save your life.

Google dorks are like the Swiss Army knife of the digital world—maybe not something you need every day, but on those rare occasions, they prove to be fucking invaluable. Whether it is fresh CC dumps, leaked databases, or vulnerable admin panels that youre hunting, knowing how to build a proper query at times saves hours of work.

So why am I bothering to teach you this if its not an everyday tool? Well, knowledge is power, and in this game, the more tools you have, the better. You may strike out nine times out of ten, but that tenth time? You could hit the mother lode.
In this guide, well cover:

The basics of dorks and how they work

Advanced techniques for finding sensitive information

How to automate your searches for maximum efficiency

Remember, this isnt about becoming a full-time digital trash collector. It’s like having another tool in the toolbox. You want to use it carefully and you want to use it sparingly; but when you need it you’ll be glad you have it

Let’s get started and see what we find.

What the Fuck Are Dorks?
When I say dorks, and Im not talking about the nerds you bullied in high school. In our world, dorks are the skeleton keys to the internets vault of secrets.

At its core, a dork is an advanced search query that tells search engines exactly what kind of dirty laundry youre looking to air out. Its like giving Google a treasure map and saying, "X marks the fucking spot."
Now, why should you care? Because paste sites like Pastebin, JustPasteIt, and Dumpz are digital dumpsters overflowing with leaked data. Were talking:

Full databases of user credentials
Credit card numbers with expiry dates and CVVs
API keys that could give you the keys to entire cloud infrastructures
Internal company documents that were never meant to be seen

Here’s what a dork looks like:

Code:

site:pastebin.com intext:"@gmail.com" intext:"password"

This beauty tells Google to search Pastebin for any paste containing both a Gmail address and the word "password". Its like fishing with dynamite in a barrel of fish.
But why stop at Pastebin? Lets talk GitHub. Youd be amazed at how many devs accidentally push their API keys and secret tokens to public repos. Try this on for size:

Code:

site:github.com "aws_access_key_id"

Boom. Youre now swimming in a sea of potential AWS keys.
Now, lets break down some common search terms:

Emails: "@gmail.com", "@yandex.ru"

Passwords: "password", "123456" (yes, people still use this)

API Keys: "API KEY", "SECRET_KEY="

SQL Dumps: "CREATE TABLE IF NOT EXISTS"

Tokens: "oauth_token="

And heres where it gets good. Youre not limited to text. Want to find misconfigured servers? Try this:

Code:

intitle:"Index of /" +passwd

This searches for directory listings that might contain password files. Swap out "passwd" for "wallet.dat", and you might stumble upon some poor bastards crypto wallet.
If a site asks for SSNDOB, do I buy a Fullz/SSNDob from a seller? Fuck no, I just run the code below and I get a trove of free SSNDOBs.

Code:

site:pastebin.com "ssndob"

Now, if youre serious about this, you need to collect as much good stuff as you can. Sites like psbdmp.ws give you real-time updates on new pastes. And there are a bunch of other sites that can do the scanning for you, with some even letting you search through tens of different paste sites at the same time.
The beauty of dorks is their flexibility. You can chain these fuckers together, mix and match site operators, and craft queries so specific they'll make a surgeon jealous. Its not about scraping up sensitive data, but finding precisely what one is looking for.

In the next section well get deeper into crafting these queries. You'll learn how to think like both the hacker and the hunted, predicting where valuable info might be hiding and how to coax Google into coughing it up.

Crafting Dorks: Your Digital Lockpicking Set
When practicing your dork game, you need to beyond basic searches in to the realm of precision. You need to remember, there are millions if pages indexed on Google daily, and perhaps thousands of leaked pastes a day; what that means is you need to be surgical in analysing which data is good and which one is hot garbage.

Lets break this down by what youre after:

1. Credit Card Information (CVV)

For those juicy credit card numbers, try:

Code:

site:pastebin.com "credit card" "cvv" "expiration"

This catches posts with credit card details. Add specific card types like "Visa" or "Mastercard" to narrow it down.

2. Dumps

For full-on database dumps, cast a wider net:

Code:

site:pastebin.com OR site:github.com "BEGIN DUMP" "END DUMP"

This catches idiots whove pasted entire database dumps. Add keywords like "users" or "accounts" to refine your search.

3. SSN/DOB (SSNDB)

Fishing for identity info? Try:

Code:

site:pastebin.com "SSN" "DOB" -"example"

The "-example" excludes posts just showing formats. Add "intext:|" if youre looking for pipe-delimited data.

4. Passwords

For the motherlode of passwords:

Code:

site:pastebin.com "email:password" OR "username:password"

Refine with specific domains like "@gmail.com" to target particular services.

5. API Keys and Tokens

Heres where GitHub becomes your best friend:

Code:

site:github.com "API_KEY" "API_SECRET" ext:yml OR ext:yaml OR ext:config

This sniffs out API keys in configuration files. Replace "API_KEY" with specific services like "TWITTER_API" or "AWS_SECRET".

6. Admin Panels

Want to find exposed admin panels? Try:

Code:

intitle:"Index of" inurl:admin

This searches for directory listings of admin folders. Replace "admin" with "login", "user", etc., for more results.

7. SQL Injection Vulnerabilities

For potential SQL injection points:

Code:

inurl:php?id= "You have an error in your SQL syntax"

This finds pages with SQL errors exposed, often a sign of vulnerability.

8. Government Leaks

Feeling patriotic? Try:

Code:

site:pastebin.com intext:".gov" filetype:xls OR filetype:xlsx

This searches for government-related Excel files on Pastebin. Swap ".gov" for other domains or file types as needed.

Some more targeted queries:

1. Banking and Financial Institutions

Code:

site:.bank.com filetype:pdf intext:"internal use only" OR intext:"confidential"

This dork targets potentially sensitive documents from banking domains.

2. Government Agencies

Code:

site:.gov ext:xls OR ext:xlsx intext:"SSN" OR intext:"Social Security"

Aims to find Excel files on government sites that might contain sensitive personal information.

3. Healthcare Providers

Code:

site:.edu inurl:health filetype:pdf intext:"patient data" OR intext:"medical records"

Searches for potentially exposed medical information on educational institutions' health services.

Advanced Techniques

Time-based searches: Use "daterange:" to find fresh leaks. Example:

Code:

daterange:2458849-2458855 site:pastebin.com "password"

This searches for password leaks in the last week.

Negative keywords: Use "-" to exclude irrelevant results. Example:

Code:

site:github.com "API_KEY" -"example" -"test" -"sample"

Wildcard searches: Use "" for unknown terms. Example:

Code:

site:pastebin.com "username:" "password:*"

Proximity searches: Use AROUND(X) to find terms near each other. Example:

Code:

site:pastebin.com "credit card" AROUND(3) "cvv"

Remember, the key to crafting effective dorks is thinking like both the accidental leaker and the intentional hacker. What common mistakes do people make when sharing code? What formats do dumps usually take?

Finally, we have these tools to help you further master dorking/dumpster diving:

Exploit Database - Google Hacking Database (GHDB): A comprehensive repository of Google dorks for finding sensitive data.
HackTricks - GitHub Leaked Secrets: A guide to uncovering sensitive information and leaked secrets on GitHub.
Google Dorks Simplified: A curated collection of simplified Google dorks to help you find hidden information.
GDorks: A GitHub repository focused on Google dorks, providing a variety of search queries for discovering sensitive data.
DorkSearch: A search engine specifically designed to find sensitive information using Google dorks.
RedHunt Labs - Online IDE Search: A tool for searching sensitive information in online IDEs using Google dorks.

Using Scripts + Automation: Turning Your Dork Game Up to 11
Now that youve finally got the craft of dorks down its time to stop manually sifting through data like some 20th-century chump. Were going to automate this shit and turn dumpster diving into a 24/7 harvesting operation.

First up, lets talk about Monitor-pastebin-leaks. This script is like having a crackhead intern who never sleeps, constantly refreshing Pastebin for you. Heres how it works:

Code:

bash MONITOR_pastebin.sh

Run this bad boy, and itll grep raw data against your custom regex, download matching files, and alert you when it finds something juicy. Want it to run every 5 minutes? Throw this in your crontab:

Code:

*/5 * * * * bash /path/to/MONITOR_pastebin.sh

But why stop at Pastebin? Enter PasteHunter. This tool takes your Google dorks and automates the search across multiple paste sites. Heres how to set it up:

Code:

pip3 install -r requirements.txt
mkdir raw
python3 app.py

In the app.py file, change the query variable to your desired dork. For example:

Code:

query = "site:pastebin.com intext:smtp.sendgrid.net"

This will hunt for SendGrid SMTP credentials across Pastebin. Adjust as needed for your specific targets.
Now, for you advanced fuckers out there, lets talk about chaining these tools together. Imagine running PasteHunter to find fresh pastes, feeding those into Monitor-pastebin-leaks for deeper analysis, and then having the results sent to your own custom script that, say, automatically tests found credentials.
But remember, with great power comes great responsibility: automate and scrape carefully. You dont want to accidentally DOS a paste site or, worse, automate yourself into a federal prison, lmao!

Heres a quick Python script to get you started on building your own automated dork hunter:

Code:

import requests
from bs4 import BeautifulSoup
import re
def search_pastebin(query):
url = f"https://google.com/search?q=site:pastebin.com+{query}"
response = requests.get(url)
soup = BeautifulSoup(response.text, 'html.parser')
for link in soup.find_all('a'):
    href = link.get('href')
    if 'pastebin.com' in href:
        paste_url = href.split('&')[0].replace('/url?q=', '')
        yield paste_url
def analyze_paste(url):
response = requests.get(url)
content = response.text
# Add your own regex patterns here
patterns = [
    r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',  # Email
    r'\b(?:\d{4}[-\s]?){3}\d{4}\b',  # Credit Card
]

for pattern in patterns:
    if re.search(pattern, content):
        print(f"Found match in {url}")
        # Add your own logic here (e.g., save to file, send alert)
if name == "main":
query = "password database"  # Change this to your desired search term
for paste_url in search_pastebin(query):
analyze_paste(paste_url)

This script searches Pastebin via Google, fetches each result, and analyzes it for patterns you define. Its basic, but its a start. Expand on this. Make it your own. Add more sites, more patterns, smarter analysis.
The key to successful automation is balance. You want to cast a wide net, but not so wide that youre drowning in false positives and garbage. Start small, refine your patterns, and gradually scale up.

Wrapping Up: The Dumpster Divers Dilemma

So, youve made it through the digital dumpster dive. Youre a trash connoisseur now. But lets be real here.

Heres the thing about Google dorks/ paste site scraping/ dumpster diving: its a fucking rabbit hole. One minute youre looking for a simple CC dump the next youre up to your neck in government conspiracy theories and some Indian’s homework for his economics class. Its easy to get lost in the sauce.
But heres why it matters: Its a fallback. When your usual methods fail, and youre too poor or cheap to spend on cards and logs, this could be your ace in the hole.

Remember, the goal isnt to become a full-time digital archaeologist. Its to be a well-rounded, dangerous carder. This is just another tool in your kit, not your whole damn identity.
So use it wisely, automate what you can, and dont let it consume you. The real moneys in the carding, not the searching for trash.

Now go forth and conquer, you beautiful dumpster divers.

eb303623 · Aug 6, 2024

Great

zrollo · Aug 8, 2024

fuck yeah

darckxplit · Sep 8, 2024

I have always wanted to have a broader view of the dork and I feel that today it was time, sometimes I thought that the dork had lost a little strength, because these were used a few years ago to find errors in sites and make SQL injection attacks and worked wonderfully, but suddenly I felt that I had lost flavor to this dorks even though what you explain is something basic, but I found concepts one or the other unknown that opened my eyes again. Thank you very much for the material.

d0ctrine · Sep 8, 2024

darckxplit said:
I have always wanted to have a broader view of the dork and I feel that today it was time, sometimes I thought that the dork had lost a little strength, because these were used a few years ago to find errors in sites and make SQL injection attacks and worked wonderfully, but suddenly I felt that I had lost flavor to this dorks even though what you explain is something basic, but I found concepts one or the other unknown that opened my eyes again. Thank you very much for the material.

Yep. Dorks will never not be useful as it is the most important part of finding targets. Even hitting sites that are vulnerable use dorking, either via Google or most likely via FOFA and other device search engines.

darckxplit · Sep 9, 2024

d0ctrine said:
Sí. Dorks nunca dejará de ser útil, ya que es la parte más importante para encontrar objetivos. Incluso para atacar sitios vulnerables, se utiliza Dorking, ya sea a través de Google o, muy probablemente, a través de FOFA y otros motores de búsqueda de dispositivos.

Puedo contactarme contigo por mensajes en privado o tienes un grupo donde pueda acceder a el ?

🗑️ Carding/Hacking Bites: Digital Dumpster Diving with Google Dorks 🗑️

d0ctrine

Fraud Daddy

eb303623

Carding Crew Leader

zrollo

Carding Novice

darckxplit

d0ctrine

Fraud Daddy

darckxplit