Google Dorking (Search operators)

What is Google Dorking (Search operators)?

Google dorking is a search-operator skill (not a Kali binary): you combine site:, filetype:, inurl:, intitle:, and related operators to find publicly indexed pages, docs, and misconfigurations. Results come from the search engine’s index — you are not scanning the target yourself.

Passive discovery of exposed documents, login portals, and indexed paths on domains you own or are authorized to investigate — always within Google ToS and local law.

Official website: Google Dorking (Search operators) · Documentation

When do you use it?

• You need a quick view of what Google already indexed for your domain.
• You are hunting forgotten PDFs, backups, or admin paths that should not be public.
• You want passive recon before active scanning in an authorized engagement.

When not to use it

• Do not use dorks to harvest credentials or private data from systems you do not own.
• Do not automate aggressive scraping against Google (ToS / blocking).

Who uses it?

• OSINT analysts
• Investigators (lawful use)
• Red teamers (authorized recon)

How do you use it? (typical flow)

1. Learn the main operators (site, filetype, inurl, intitle, cache, related).
2. Combine operators into a precise query scoped to an authorized domain.
3. Review hits carefully — indexed ≠ currently live; verify on your own assets.
4. Document findings and remediate exposure (robots, auth, take-down).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

1. 1. Google Search operators (official)

   https://support.google.com/websearch/answer/2466433

   Vendor reference for supported operators — like a man page for the search box.

2. 2. GHDB (learning only)

   https://www.exploit-db.com/google-hacking-database

   Historical operator examples — use patterns ethically on in-scope assets only.

1. Installation

2. Basic commands

1. 1. Limit to one domain + PDFs

   site:example.com filetype:pdf

   Replace example.com with a domain you may search.

2. 2. Find paths containing login

   site:example.com inurl:login

   Surfaces indexed auth-related URLs — verify ownership before testing.

3. 3. Title-based discovery

   site:example.com intitle:"index of"

   Classic directory-listing dork — often indicates misconfiguration.

4. 4. Exclude noise

   site:example.com -www -cdn filetype:xls OR filetype:xlsx

   Boolean OR and minus filters refine results.

5. 5. Cached snapshot hint

   cache:https://example.com/path

   Shows Google’s last cached copy when available.

Options / flags

5. Useful features

• No install — works in any browser
• Passive (search-index) discovery
• Complements DNS/OSINT tools
• Useful for exposure hygiene on your own brand

6. Practical examples

1. Example 1: Limit to one domain + PDFs

   site:example.com filetype:pdf

   Replace example.com with a domain you may search.

2. Example 2: Find paths containing login

   site:example.com inurl:login

   Surfaces indexed auth-related URLs — verify ownership before testing.

3. Example 3: Title-based discovery

   site:example.com intitle:"index of"

   Classic directory-listing dork — often indicates misconfiguration.

4. Example 4: Exclude noise

   site:example.com -www -cdn filetype:xls OR filetype:xlsx

   Boolean OR and minus filters refine results.

5. Example 5: Cached snapshot hint

   cache:https://example.com/path

   Shows Google’s last cached copy when available.

7. Important notes

• Defenders use dorks to find leaks; attackers do too — fix findings, don't exploit third parties.
• Authorized targets only — labs, systems you own, or written permission.
• Prefer reading --help / man / official docs for your installed version; flags change over time.