Same goes for other configuration or settings files. For instance, connection strings in web.config files (connection string file:web.config), Movable Type passwords (file:mt-db-pass.cgi), keygen name serial, backdoor passwords (backdoor.*password), MySQL root passwords (file:config.inc.php “MySQL password” root, etc.

Of course, one could search for code vulerable to cross-site scripting, SQL Injection (lang:php mysql_query\(.*\$_(GET|POST|COOKIE|REQUEST).*\)), remote code execution (lang:php (include|require)\s*(\(|\s).*\$_(GET|POST)), header injection, and on and on.

Spammers can cull email addresses from code with a simple code search as well ([a-z]*@[a-z]*.com)

So what have we learned?

• Do not put passwords in public code, including zipped code archives.
• Be more diligent to protect against SQL Injection and similar exploits. I.e. do not trust user input of any sort.
• Do not put email addresses in public code.
• In general, keep your eyes and ears open for security exploits and protect against them.

We can’t be perfect, but we ought to try.

Seen here, here, and here.

You can limit the results to languages (lang:), particular licenses (license:), files (file:), and packages (package:). Regular expressions are supported as well.

Language support appears to be limited to the following: Ada, ASP, Assembly, Basic, C, C++, C#, Eiffel, Erlang, Fortran, Java, JavaScript, JSP, Lex, Limbo, Lisp, Lua, Makefile, Mathematica, Matlab, Objective C, Perl, PHP, PostScript, Python, Ruby, Scheme, Shell, Smalltalk, SQL, Tcl, Troff, and Yacc. Wonder why no COBOL, SNOBOL, PL1, Pascal, JCL, etc.? Besides “they’re old languages.” Unfortunately, not everyone is hip and happening, and programmers struggling to support old systems are likely to need a good resource like this. Google, can you add some languages?

Anyhow, support for regular expressions is welcome. The licenses you can use in the searches include: Aladdin Public License, Artistic License, Apache License, Apple Public Source License, BSD License, Common Public License, GNU General Public License, GNU Lesser General Public License, Historical Permission Notice and Disclaimer, IBM Public License, Lucent Public License, MIT License, Mozilla Public License, NASA Open Source Agreement, Python Software Foundation License, Q Public License, Sleepycat License, and the Zope Public License.

Some example searches:

• blowfish lang:javascript
• obfuscate lang:php
• screen.*scrape lang:c
• file:\.js$ sneaky
• find.*path lang:c++ -license:gpl

Seen here.

This is another instance where Yahoo is on top of the game, instead of Google. Everywhere else they are playing catchup.

Competition is good.

Most of the code is GPL, so you won’t be able to use it in commercial applications (unless it is for internal use only).

Also, the server is a poor old Celeron so don’t expect any blazingly fast searches.