nerdexam
GIAC

GPEN · Question #168

You want to retrieve the default security report of nessus. Which of the following google search queries will you use?

The correct answer is C. filetype:pdf "Assessment Report" nessus. Google hacking uses advanced search operators to surface sensitive documents left exposed online. The correct dork combines filetype:pdf with a quoted exact phrase to locate default Nessus assessment reports.

Penetration Testing Foundations & Reconnaissance

Question

You want to retrieve the default security report of nessus. Which of the following google search queries will you use?

Options

  • Asite:pdf nessus "Assessment report"
  • Bfiletype:pdf nessus
  • Cfiletype:pdf "Assessment Report" nessus
  • Dlink:pdf nessus "Assessment report"

How the community answered

(38 responses)
  • A
    13% (5)
  • B
    3% (1)
  • C
    76% (29)
  • D
    8% (3)

Why each option

Google hacking uses advanced search operators to surface sensitive documents left exposed online. The correct dork combines filetype:pdf with a quoted exact phrase to locate default Nessus assessment reports.

Asite:pdf nessus "Assessment report"

The `site:` operator filters results by domain name, not file extension, so `site:pdf` is invalid syntax and will not return PDF files.

Bfiletype:pdf nessus

`filetype:pdf nessus` omits the quoted phrase `"Assessment Report"` and returns an overly broad set of Nessus-related PDFs, not specifically default assessment reports.

Cfiletype:pdf "Assessment Report" nessusCorrect

The query `filetype:pdf "Assessment Report" nessus` correctly uses the `filetype:` operator to restrict results to PDF documents and the quoted phrase `"Assessment Report"` to match the exact string found in Nessus default report titles, combined with the keyword nessus to filter for that tool specifically. This precise combination targets Nessus scan output PDFs that have been inadvertently indexed by Google, which is a common Google hacking technique for finding exposed vulnerability reports.

Dlink:pdf nessus "Assessment report"

The `link:` operator searches for pages that link to a specified URL, not for file types, making `link:pdf` invalid syntax for retrieving PDF documents.

Concept tested: Google dork filetype operator for locating exposed security reports

Source: https://developers.google.com/search/docs/monitor-debug/search-operators/all-search-site

Topics

#Google hacking#search operators#OSINT#Nessus reports

Community Discussion

No community discussion yet for this question.

Full GPEN Practice