GPEN · Question #311
You want to search Microsoft Outlook Web Access Default Portal using Google search on the Internet so that you can perform the brute force attack and get unauthorized access. What search string will…
The correct answer is D. allinurl:"exchange/logon.asp". The Google dork 'allinurl:"exchange/logon.asp"' targets the default Microsoft Exchange Outlook Web Access login page URL, making it the correct search string for locating OWA portals.
Question
You want to search Microsoft Outlook Web Access Default Portal using Google search on the Internet so that you can perform the brute force attack and get unauthorized access. What search string will you use to accomplish the task?
Options
- Aintitle:"Index Of" -inurl:maillog maillog size
- Bintext:"outlook.asp"
- Cintitle:index.of inbox dbx
- Dallinurl:"exchange/logon.asp"
How the community answered
(50 responses)- A2% (1)
- B8% (4)
- C6% (3)
- D84% (42)
Why each option
The Google dork 'allinurl:"exchange/logon.asp"' targets the default Microsoft Exchange Outlook Web Access login page URL, making it the correct search string for locating OWA portals.
The string 'intitle:"Index Of" -inurl:maillog maillog size' is used to find exposed mail log files on web servers, not Outlook Web Access login portals.
The string 'intext:"outlook.asp"' searches for page body text containing 'outlook.asp' and is too broad and imprecise to reliably target Exchange OWA login pages.
The string 'intitle:index.of inbox dbx' is used to find exposed Outlook Express mailbox (.dbx) files in open directory listings, not OWA login portals.
The default login path for Microsoft Outlook Web Access on Exchange servers is '/exchange/logon.asp', and the 'allinurl:' operator restricts results to pages where all specified terms appear in the URL. This query reliably surfaces publicly indexed OWA login pages, which can then be targeted for brute-force or credential-stuffing attacks. It is the most precise dork for OWA because it matches the actual default URL path rather than page text or titles.
Concept tested: Google dorking to locate Outlook Web Access portals
Source: https://learn.microsoft.com/en-us/exchange/clients/outlook-on-the-web/outlook-on-the-web
Topics
Community Discussion
No community discussion yet for this question.