Google Dorking

Details

ID	`Google Dorking`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	6.2.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Automate the process of google dorking searches in order to detect leaked data.

Configure Google Dorking in Cortex

Parameter	Description	Required
Search engine ID		True
API Key		True
File Types to Search	Comma separated file types that’ll be searched and downloaded.	True
Search Keywords	Comma separated keywords to look for in the files.	False
Sites To Search	Provide a single or comma separated list of sites from which to perform the search on.	True
Fetch incidents		False
Incident type		False
Maximum number of incidents per fetch		False
First fetch time		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Incidents Fetch Interval		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

google-dorking-search

Use the google search engine to search a query.

Base Command

google-dorking-search

Input

Argument Name	Description	Required
after	Search after this date. Expected format: YYYY-MM-DD.	Optional
file_types	Comma separated file types that’ll be searched and downloaded.	Optional
keywords	Comma separated keywords to look for in the files.	Optional
urls	Provide a single or comma separated list of sites from which to perform the search on.	Optional

Context Output

There is no context output for this command.

Command Example

``````

Human Readable Output

Configuration parameters

apiKey — Search engine ID (required)
file_types — File Types to Search (required)
keywords — Search Keywords
urls — Sites To Search (required)
isFetch — Fetch incidents
incidentType — Incident type
max_fetch — Maximum number of incidents per fetch
first_fetch — First fetch time
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentFetchInterval — Incidents Fetch Interval

Commands (1)

google-dorking-search
Use the google search engine to search a query.

Source

GoogleDorking.py GoogleDorking_test.py GoogleDorking.yml GoogleDorking_description.md

Download History Raw

commonfields:
  id: Google Dorking
  version: -1
name: Google Dorking
display: Google Dorking
category: Data Enrichment & Threat Intelligence
provider: Open Source
description: Automate the process of google dorking searches in order to detect leaked data.
configuration:
- display: Search engine ID
  displaypassword: API Key
  name: apiKey
  type: 9
  required: true
- display: File Types to Search
  name: file_types
  type: 16
  required: true
  options:
  - pdf
  - ps
  - dwf
  - kml
  - kmz
  - gpx
  - hwp
  - htm
  - html
  - xls
  - xlsx
  - ppt
  - pptx
  - doc
  - docx
  - odp
  - ods
  - odt
  - rtf
  - svg
  - tex
  - txt
  - text
  - log
  - md
  - bas
  - c
  - cc
  - cpp
  - cxx
  - h
  - hpp
  - cs
  - java
  - pl
  - py
  - wml
  - wap
  - xml
  additionalinfo: File types that'll be searched and downloaded.
- display: Search Keywords
  name: keywords
  type: 12
  additionalinfo: Comma separated keywords to look for in the files.
  required: false
- display: Sites To Search
  name: urls
  type: 12
  required: true
  additionalinfo: Provide a single or comma separated list of sites from which to perform the search on.
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: '100'
  type: 0
  required: false
- display: First fetch time
  name: first_fetch
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '60'
  type: 19
  required: false
script:
  script: ''
  type: python
  commands:
  - name: google-dorking-search
    arguments:
    - name: after
      description: 'Search after this date. Expected format: YYYY-MM-DD.'
    - name: file_types
      auto: PREDEFINED
      predefined:
      - pdf
      - ps
      - dwf
      - kml
      - kmz
      - gpx
      - hwp
      - htm
      - html
      - xls
      - xlsx
      - ppt
      - pptx
      - doc
      - docx
      - odp
      - ods
      - odt
      - rtf
      - svg
      - tex
      - txt
      - text
      - log
      - md
      - bas
      - c
      - cc
      - cpp
      - cxx
      - h
      - hpp
      - cs
      - java
      - pl
      - py
      - wml
      - wap
      - xml
      description: Comma separated file types that'll be searched and downloaded.
      isArray: true
    - name: keywords
      description: Comma separated keywords to look for in the files.
    - name: urls
      description: Provide a single or comma separated list of sites from which to perform the search on.
    description: Use the google search engine to search a query.
  dockerimage: demisto/python3:3.12.8.3296088
  isfetch: true
  subtype: python3
fromversion: 6.2.0
tests:
- No tests (auto formatted)