Google Dorking
Google search operators can be used to narrow search results and identify exposed information about a target.
Common Operators
| Operator | Description |
|---|---|
site: | Restrict results to a specific domain |
filetype: | Search for specific file types |
-filetype: | Exclude specific file types |
ext: | Search by file extension (equivalent to filetype:) |
intitle: | Search within page titles |
allintitle: | Require all terms in the title |
inurl: | Search within URLs |
allinurl: | Require all terms in the URL |
intext: | Search within page body text |
"..." | Exact-phrase match |
OR / | | Match either term |
- | Exclude a term (e.g. -www) |
* | Wildcard placeholder for a word |
AROUND(n) | Two terms within n words of each other |
Useful Dork Examples
Search for non-HTML content on a target domain:
site:websiteOfInterest.com -filetype:html
Search for specific file types:
site:websiteOfInterest.com ext:xml
site:websiteOfInterest.com ext:py
site:websiteOfInterest.com ext:conf
Find exposed directory listings:
intitle:"index of" "parent directory"
The output from directory listing dorks can reveal interesting files and sensitive information from misconfigured servers.
High-Value Recon Dorks
Exposed login / admin panels:
site:target.com inurl:(login | admin | dashboard | portal | signin)
Config, backup, database, and secret files:
site:target.com ext:(sql | db | bak | old | log | env | ini | conf | yml | yaml)
site:target.com intext:(password | passwd | pwd | api_key | secret)
Exposed .git directories and source leaks:
site:target.com inurl:.git
site:target.com inurl:(.svn | .env | wp-config | config.php.bak)
Directory listings scoped to sensitive content:
site:target.com intitle:"index of" (backup | admin | db | password)
Error messages and stack traces (reveal stack, paths, versions):
site:target.com intext:("sql syntax near" | "fatal error" | "stack trace" | "warning: mysql")
Cloud storage and documents tied to the org:
site:s3.amazonaws.com target.com
site:target.com ext:(pdf | docx | xlsx | pptx)
Automation
The Google Hacking Database can be automated with pagodo (feeds GHDB dorks through a search engine):
pagodo -d target.com -g dorks.txt -o results.json
Automated dorking triggers CAPTCHAs and temporary IP blocks quickly. Throttle requests, rotate through engines (DuckDuckGo, Bing, Yandex all support similar operators), and keep bulk runs slow. Note: Google retired the cache: operator in 2024 — use the Wayback Machine for historical snapshots instead.
Resources
- Google Hacking Database: https://www.exploit-db.com/google-hacking-database
- Dork practice: https://dorksearch.com/