nerdexam
GIAC

GPEN · Question #311

You want to search Microsoft Outlook Web Access Default Portal using Google search on the Internet so that you can perform the brute force attack and get unauthorized access. What search string will…

The correct answer is D. allinurl:"exchange/logon.asp". The Google dork 'allinurl:"exchange/logon.asp"' targets the default Microsoft Exchange Outlook Web Access login page URL, making it the correct search string for locating OWA portals.

Penetration Testing Foundations & Reconnaissance

Question

You want to search Microsoft Outlook Web Access Default Portal using Google search on the Internet so that you can perform the brute force attack and get unauthorized access. What search string will you use to accomplish the task?

Options

  • Aintitle:"Index Of" -inurl:maillog maillog size
  • Bintext:"outlook.asp"
  • Cintitle:index.of inbox dbx
  • Dallinurl:"exchange/logon.asp"

How the community answered

(50 responses)
  • A
    2% (1)
  • B
    8% (4)
  • C
    6% (3)
  • D
    84% (42)

Why each option

The Google dork 'allinurl:"exchange/logon.asp"' targets the default Microsoft Exchange Outlook Web Access login page URL, making it the correct search string for locating OWA portals.

Aintitle:"Index Of" -inurl:maillog maillog size

The string 'intitle:"Index Of" -inurl:maillog maillog size' is used to find exposed mail log files on web servers, not Outlook Web Access login portals.

Bintext:"outlook.asp"

The string 'intext:"outlook.asp"' searches for page body text containing 'outlook.asp' and is too broad and imprecise to reliably target Exchange OWA login pages.

Cintitle:index.of inbox dbx

The string 'intitle:index.of inbox dbx' is used to find exposed Outlook Express mailbox (.dbx) files in open directory listings, not OWA login portals.

Dallinurl:"exchange/logon.asp"Correct

The default login path for Microsoft Outlook Web Access on Exchange servers is '/exchange/logon.asp', and the 'allinurl:' operator restricts results to pages where all specified terms appear in the URL. This query reliably surfaces publicly indexed OWA login pages, which can then be targeted for brute-force or credential-stuffing attacks. It is the most precise dork for OWA because it matches the actual default URL path rather than page text or titles.

Concept tested: Google dorking to locate Outlook Web Access portals

Source: https://learn.microsoft.com/en-us/exchange/clients/outlook-on-the-web/outlook-on-the-web

Topics

#Google dorking#OSINT#Outlook Web Access#search operators

Community Discussion

No community discussion yet for this question.

Full GPEN Practice