← Back to Shield House Hexworth Prime

Google Dorking (OSINT)

Advanced search operators for reconnaissance and open-source intelligence gathering

Ethical Use Only: Google dorking should only be used for authorized security assessments, bug bounties, or educational purposes. Unauthorized reconnaissance may violate laws and terms of service.

Core Operators

Operator Purpose Security Example
filetype: Return specific file types filetype:pdf "security policy"
intitle: Term in page title intitle:"index of" passwords
inurl: Term in URL path inurl:admin login
intext: Term in body text intext:"sql syntax error"
site: Restrict to domain site:target.com filetype:sql
- (minus) Exclude terms site:target.com -www
"..." Exact phrase "password" filetype:txt
OR Match either term (admin OR login) site:target.com
cache: View cached version cache:target.com
ext: File extension (alt) ext:conf inurl:config
Combine freely Case insensitive Order doesn't matter

Reconnaissance Categories

Sensitive Files

  • filetype:sql - Database dumps
  • filetype:log - Server logs
  • filetype:conf OR filetype:config - Config files
  • filetype:env - Environment files
  • filetype:bak OR filetype:backup - Backups

Login Portals

  • inurl:admin - Admin panels
  • inurl:login - Login pages
  • inurl:wp-admin - WordPress admin
  • intitle:"phpMyAdmin" - Database panels

Directory Listings

  • intitle:"index of" - Open directories
  • intitle:"parent directory" - Directory listing

Always scope your searches to authorized targets using site:

Copy-Paste Queries

  1. Find exposed config files
    site:target.com (filetype:conf OR filetype:config OR filetype:env)
  2. Directory listings with sensitive files
    intitle:"index of" (passwd OR password OR credentials)
  3. SQL error messages (indicates SQLi)
    site:target.com intext:"sql syntax" OR intext:"mysql_fetch"
  4. Exposed admin panels
    site:target.com inurl:admin OR inurl:login OR inurl:portal
  5. Backup files
    site:target.com (ext:bak OR ext:old OR ext:backup OR ext:sql)
  6. Exposed .git directories
    intitle:"index of" ".git"
  7. WordPress vulnerabilities
    site:target.com inurl:wp-content OR inurl:wp-includes
  8. Exposed API keys
    site:target.com (intext:"api_key" OR intext:"apikey" OR intext:"secret_key")
  9. Log files with errors
    filetype:log site:target.com (error OR warning OR exception)
  10. Subdomains discovery
    site:*.target.com -www

Live Query Builder

Build your dork and test it directly in Google:

site:example.com (filetype:conf OR filetype:env OR filetype:sql)

Google Hacking Database

For more dorks, check out: