Listen to this Post
FOFA is a powerful search engine designed for cybersecurity professionals, enabling them to perform advanced reconnaissance using specific search queries (dorks). Below are two key resources for mastering FOFA dorking:
– Part 1: FOFA Dorking Basics
– Part 2: Advanced FOFA Dorking Techniques
You Should Know: Essential FOFA Dorking Commands and Techniques
1. Basic FOFA Dorking Queries
FOFA allows users to search for exposed assets using syntax similar to Google dorking. Here are some fundamental queries:
– `title=”Login”` – Finds pages with “Login” in the title.
– `header=”Apache”` – Searches for servers running Apache.
– `body=”admin panel”` – Locates pages containing “admin panel” in the body.
2. Targeting JavaScript Files
To find sensitive data in JS files:
– `js_content=”api_key”` – Searches JavaScript files containing “api_key”.
– `js_content=”password” && domain=”example.com”` – Finds JS files with “password” on a specific domain.
3. Finding Vulnerable Services
– `app=”Jenkins”` – Discovers exposed Jenkins instances.
– `app=”WordPress” && country=”US”` – Locates WordPress sites hosted in the US.
– `port=”3389″` – Searches for open RDP ports.
4. Advanced Recon with Certificates
– `cert.subject=”.google.com”` – Finds domains using Google SSL certificates.
– `cert.is_valid=true` – Lists websites with valid SSL certificates.
5. Automating FOFA Searches
Use Python to automate FOFA queries:
import requests
api_key = "YOUR_FOFA_API_KEY"
query = 'app="Apache"'
url = f"https://fofa.info/api/v1/search/all?email=YOUR_EMAIL&key={api_key}&qbase64={query}"
response = requests.get(url)
print(response.json())
6. Linux Command-Line Recon Tools
Combine FOFA with CLI tools for deeper analysis:
- Curl: `curl -s “https://fofa.info/api/v1/search/all?key=API_KEY&q=QUERY” | jq`
- Nmap: `nmap -p 80,443 $(curl -s “FOFA_API_URL” | jq -r ‘.results[]’)`
7. Defensive Measures Against Dorking
- Disable Directory Listings:
Apache sudo sed -i 's/Options Indexes FollowSymLinks/Options -Indexes +FollowSymLinks/' /etc/apache2/apache2.conf sudo systemctl restart apache2 Nginx sudo nano /etc/nginx/nginx.conf Add: autoindex off; sudo systemctl restart nginx
What Undercode Say
FOFA dorking is a double-edged sword—essential for ethical hackers but dangerous in malicious hands. Mastering it requires understanding both offensive and defensive techniques. Always use FOFA responsibly and ensure your own infrastructure is secure against such reconnaissance methods.
Expected Output:
- A list of exposed assets based on FOFA queries.
- Automated scripts for large-scale reconnaissance.
- Hardened server configurations to prevent unauthorized access.
Prediction
FOFA and similar OSINT tools will evolve with AI-driven query suggestions, making reconnaissance faster and more precise. Ethical hackers must stay ahead by developing counter-recon strategies.
References:
Reported By: Abhirup Konwar – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
