DEV Community

Abhinav Singwal
Abhinav Singwal

Posted on

Google Dorking: 20 Queries That Expose What Search Engines Index

#googledorks #dorks #cybersecurity #bugbounty

Google Dorking, also known as Google Hacking, is a passive reconnaissance technique that leverages advanced search operators to uncover sensitive information, exposed files, and vulnerable systems that have been indexed by search engines . Unlike active scanning tools such as Nmap or ffuf, dorking leaves no trace on the target's infrastructure because every query goes to Google's servers, not the target itself . For bug bounty hunters, penetration testers, and security researchers, mastering these operators transforms a standard search engine into one of the most powerful intelligence-gathering tools available.

Google Dork Commands for Pentesting

1. Basic Site Restriction 

site:example.com
Enter fullscreen mode Exit fullscreen mode

The site: operator restricts results to a specific domain. This is the foundational dork for mapping a target's indexed footprint. Combine it with keywords to narrow results, or use it alone to see approximately how many pages Google has indexed from the target .

2. Subdomain Discovery 

site:*.example.com
Enter fullscreen mode Exit fullscreen mode

The wildcard before the domain returns all subdomains that Google has crawled. This expands the attack surface by revealing development, staging, and administrative subdomains that may have weaker security controls than the main application .

3. Targeted Subdomain Search 

site:*.example.com inurl:developer
Enter fullscreen mode Exit fullscreen mode

Combining site: with inurl: surfaces subdomains containing a specific keyword. Development and testing environments frequently expose debugging interfaces, default credentials, or unpatched software that production systems have already remediated .

4. Open Directory Listings 

intitle:"index of" site:example.com
Enter fullscreen mode Exit fullscreen mode

The intitle: operator matches pages with specific text in the HTML title. Web servers with directory listing enabled display "Index of /" in their title. These open directories expose file structures and sometimes contain backup files, configuration files, and source code .

5. Exposed Environment Files 

site:example.com filetype:env "DB_PASSWORD"
Enter fullscreen mode Exit fullscreen mode

Environment files (.env) frequently contain database credentials, API keys, and application secrets. An exposed .env file is consistently one of the highest-severity findings from dorking because a single file can provide immediate access to multiple systems .

6. Database File Discovery 

filetype:sql site:example.com
Enter fullscreen mode Exit fullscreen mode

The filetype: operator restricts results to a specific file extension. SQL files often contain database dumps with user credentials, personal information, and proprietary data. When combined with site:, this reveals database exports that were mistakenly placed in web-accessible directories .

7. Login Page Enumeration 

allinurl:"admin login"
Enter fullscreen mode Exit fullscreen mode

The allinurl: operator requires all specified terms to appear in the URL. This surfaces administrative authentication interfaces across indexed sites. Login panels are primary targets for credential stuffing and brute-force attacks .

8. WordPress Admin Panels 

inurl:wp-login.php -github
Enter fullscreen mode Exit fullscreen mode

The inurl: operator finds pages with specific text in the URL. WordPress powers a significant portion of the web, and its login panel is a well-known target. The -github exclusion removes GitHub repositories where the string appears in code rather than on live sites .

9. phpMyAdmin Installations 

intitle:"phpMyAdmin" inurl:"/phpmyadmin/"
Enter fullscreen mode Exit fullscreen mode

phpMyAdmin provides web-based database administration. Exposed installations are high-value targets because successful authentication grants direct database access. Many remain accessible with default or weak credentials .

10. Sensitive Document Discovery 

site:example.com filetype:pdf "confidential"
Enter fullscreen mode Exit fullscreen mode

Documents marked confidential are frequently indexed by search engines when organizations forget to restrict access. PDFs, Word documents, and spreadsheets often contain internal communications, financial data, and strategic plans .

11. Credential Exposure in Spreadsheets 

site:example.com filetype:xlsx "password"
Enter fullscreen mode Exit fullscreen mode

Spreadsheets are commonly used to store credentials, inventory lists, and other sensitive data in business environments. The filetype: operator combined with password-related keywords surfaces these inadvertent disclosures .

12. Log File Exposure 

site:example.com filetype:log "error"
Enter fullscreen mode Exit fullscreen mode

Log files often contain stack traces, database connection strings, internal file paths, and occasionally cleartext credentials. The filetype:log operator restricts results to these diagnostic files .

13. Error Message Enumeration 

site:example.com "SQL syntax error"
Enter fullscreen mode Exit fullscreen mode

Verbose error messages leak critical information about the technology stack. Database errors reveal the backend DBMS, query structure, and sometimes table names. These details help attackers craft targeted exploits .

14. Technology Version Fingerprinting 

intext:"X-Powered-By" site:example.com
Enter fullscreen mode Exit fullscreen mode

The intext: operator searches page body content. Server headers and framework identifiers reveal technology versions that can be cross-referenced against vulnerability databases. Knowing that a server runs Apache 2.4.49 versus 2.4.50 determines whether CVE-2021-41773 applies .

15. Cache Retrieval 

cache:example.com
Enter fullscreen mode Exit fullscreen mode

The cache: operator displays Google's cached version of a page. This is useful when the live page has been modified or taken down but you need to see what was previously indexed. Cached versions can reveal content that has since been removed .

16. Related Site Discovery 

related:example.com
Enter fullscreen mode Exit fullscreen mode

The related: operator finds sites similar to a given URL. This helps identify partner organizations, competitors, or subsidiaries that may share infrastructure or security practices. It expands the scope of reconnaissance to adjacent targets .

17. Exposed Configuration Files 

site:example.com ext:config OR ext:conf OR ext:cfg
Enter fullscreen mode Exit fullscreen mode

Configuration files contain database connection strings, API endpoints, and application settings. The ext: operator (interchangeable with filetype:) restricts results to these file types. Multiple extensions can be combined with OR .

18. API Key and Secret Search 

site:github.com "api_key" "example.com"
Enter fullscreen mode Exit fullscreen mode

Searching code repositories for a target's domain combined with API key keywords surfaces credentials that developers have committed to public repositories. This is a common source of exposure that originates outside the target's own infrastructure .

19. Backup File Discovery 

site:example.com ext:bak OR ext:old OR ext:backup
Enter fullscreen mode Exit fullscreen mode

Backup files preserve previous versions of code and configuration. They frequently contain credentials that have since been rotated in the live version but remain valid in the backup. Common backup extensions include .bak, .old, .backup, and .swp .

20. Number Range Search 

camera $200..$500
Enter fullscreen mode Exit fullscreen mode

The number range operator (..) finds pages containing numbers within a specified range. While this example is commercial, the same operator applies to version numbers, IP addresses, and date ranges. It is useful for finding specific software versions or date-stamped documents .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top comments (0)