Skip to content

Google Dorking

Core Operators

Operator	Purpose	Example
`site:`	Restrict to a domain	`site:example.com`
`inurl:`	Term must appear in URL	`inurl:admin`
`intitle:`	Term must appear in page title	`intitle:"index of"`
`filetype:`	Search for specific file types	`filetype:pdf`
`ext:`	Same as `filetype:`	`ext:sql`
`intext:`	Term must appear in page body	`intext:"password"`
`cache:`	Google’s cached version of a page	`cache:example.com`
`-`	Exclude results	`site:example.com -www`
`""`	Exact match	`"default password"`
`OR` / `	`	Either term
`*`	Wildcard	`"password is *"`

Common Dork Patterns

Exposed directories

intitle:"index of" site:example.com
intitle:"index of" "parent directory"

site:example.com inurl:login
site:example.com intitle:"admin" inurl:admin

Sensitive files

site:example.com filetype:env
site:example.com filetype:sql "INSERT INTO"
site:example.com filetype:log
site:example.com filetype:conf inurl:web.config
ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini

Credentials and keys

site:example.com "password" filetype:txt
site:example.com "api_key" | "api_secret"
"-----BEGIN RSA PRIVATE KEY-----" filetype:key

Exposed databases and backups

site:example.com filetype:sql
intitle:"index of" "database.sql"
intitle:"index of" "backup" ext:zip | ext:tar.gz

Other Search Engine Dorks

Most operators work across engines with minor syntax differences.

Engine	Notes
Bing	Supports `site:`, `filetype:`, `inurl:`, `intitle:`. Slightly different indexing — may find pages Google missed.
DuckDuckGo	Supports `site:`, `filetype:`, `intitle:`. No `inurl:`. Uses Bing’s index under the hood.
Yandex	Strong for `.ru` domains and Eastern European targets. Supports `site:`, `mime:` (instead of `filetype:`), `url:`.

GHDB — Google Hacking Database

Pre-built dorks organized by category:

exploit-db.com/google-hacking-database

Categories include: footholds, files containing usernames/passwords, sensitive directories, web server detection, vulnerable servers, error messages.

Dorking Responsibly

Dorking public search engines is passive reconnaissance — you’re querying the search engine, not the target directly
Accessing exposed resources you find may still be unauthorized — finding it doesn’t mean you’re allowed to use it
Combine with robots.txt and sitemap.xml review for additional path discovery

Links