Back to Library

Exposed Configuration Files

Finds exposed configuration files (.config, .cfg, .ini) containing plaintext passwords and database credentials.

Intermediate
High risk - authorized use only
files

Google Dork Query:

ext:config | ext:cfg | ext:ini intext:password
0
Not verified

What It Does

This dork uses 'ext:' to target config, cfg, and ini file extensions combined with 'intext:password' to find files containing password entries. These configuration files often store database credentials, API keys, and service account passwords in plaintext or easily reversible formats.

Common Use Cases

  • Credential Exposure Detection: Find publicly accessible configuration files that contain plaintext passwords and sensitive credentials.
  • Server Hardening Audit: Identify web servers that allow direct download of configuration files containing secrets.
  • Data Breach Prevention: Proactively discover exposed credential files before they are found by malicious actors.

How to Use Safely

  1. Search Google with this dork to find configuration files containing password entries.
  2. Review the file content for database credentials, API keys, and service passwords.
  3. Assess the potential impact of the exposed credentials on the organization.
  4. Report exposed files, recommend blocking direct file access, and rotating all exposed credentials.

Responsible Use Required

This dork should only be used on systems you own or have explicit authorization to test. Unauthorized access to computer systems is illegal. Always follow ethical guidelines and obtain proper permission before testing.

TAGS

config
credentials
passwords

Related Dorks

Find MODERATOR Files

Finds exposed vBulletin moderator control panels that may allow unauthorized forum moderation actions.

Find Backup-Management (phpMyBackup v.0.4 beta * ) Pages

Finds exposed phpMyBackup management interfaces that could allow unauthorized access to MySQL database backup operations.

Google Dork: inurl:"bug bounty" and intext:"INR"...

Discovers bug bounty programs offering rewards in Indian Rupees (INR) by searching security pages with bounty payment information.