You want to retrieve password files (stored in the Web server's index directory) from various Web sites. Which of the following tools can you use to accomplish the task?

Nmap is a network scanning tool used to discover hosts, open ports, and services on a network, and does not perform web content or file searches across multiple web sites.

Sam Spade is an OSINT and network utility tool focused on DNS lookups, WHOIS queries, and traceroutes, and is not designed to search web server directory indexes for files.

Whois is a protocol and tool for querying domain registration and ownership information, and provides no capability to search for or retrieve files from web server directories.

Google supports advanced search operators such as intitle:'index of' or inurl: combined with filenames like 'passwords.txt' or 'pwd.txt', which allow a tester to locate web servers with directory listing enabled that expose sensitive files. Because Google crawls and indexes these open directories, it becomes an effective passive reconnaissance tool for finding exposed credentials and configuration files without directly interacting with the target server.