> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/passive-reconnaissance-techniques/google-dorking.md).

# Google Dorking

Google Dorking (also known as **Google Hacking**) is a technique used to extract sensitive information from publicly available websites using advanced Google search queries. This technique leverages Google’s search operators to find exposed files, misconfigured servers, and other security flaws.

***

GHDB is a publicly available resource of Google Dorks maintained by [**Exploit-DB**](https://www.exploit-db.com/google-hacking-database). It contains various dorks categorized based on the type of information they retrieve.

🔗 **Google Hacking Database (GHDB)**: <https://www.exploit-db.com/google-hacking-database>

***

## **Basic Google Search Operators**

Basic operators help refine search queries by modifying how Google interprets them.

| Operator               | Description                                                 | Example                                                                                   |
| ---------------------- | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| `+` (plus sign)        | Forces Google to include a specific word in search results. | `security +pentesting` (Ensures "pentesting" appears in results)                          |
| `-` (minus sign)       | Excludes a term from search results.                        | `security -pentesting` (Finds "security" but excludes "pentesting")                       |
| `""` (quotation marks) | Searches for an exact phrase.                               | `"ethical hacking course"` (Finds exact phrase match)                                     |
| `*` (asterisk)         | Acts as a wildcard, replacing unknown words.                | `"ethical * course"` (Finds "ethical hacking course", "ethical programming course", etc.) |
| `..` (range)           | Searches for results within a number range.                 | `"laptop $500..$1000"` (Finds laptops priced between $500 and $1000)                      |
| `~` (similar)          | Finds synonyms or related words.                            | `~security` (Finds results related to security, like "cybersecurity", "safety", etc.)     |
| `OR`                   | Finds pages containing either of the specified terms.       | `penetration testing OR ethical hacking`                                                  |

***

## **Advanced Google Search Operators**

These operators provide **precise and targeted** search results.

### **Rules for Advanced Operators**

1. **No spaces** between the operator and the search term.\
   ✅ `intitle:hacking` ❌ `intitle: hacking`
2. **Case-insensitive** (Uppercase or lowercase doesn't matter).
3. **Use quotes** if a search term contains spaces.\
   ✅ `intitle:"ethical hacking"`
4. **Combine multiple operators** for better filtering.

#### **List of Advanced Operators**

| Operator      | Description                                                       | Example                                         |
| ------------- | ----------------------------------------------------------------- | ----------------------------------------------- |
| `intitle:`    | Finds pages with a specific keyword in the title.                 | `intitle:"admin panel"`                         |
| `allintitle:` | Finds pages with multiple keywords in the title.                  | `allintitle:"login password"`                   |
| `inurl:`      | Searches for a keyword in the URL.                                | `inurl:"admin"` (Finds URLs containing "admin") |
| `allinurl:`   | Searches for multiple keywords in the URL.                        | `allinurl:"login page"`                         |
| `intext:`     | Searches for a keyword in the body text of a webpage.             | `intext:"vulnerable to SQL injection"`          |
| `allintext:`  | Searches for multiple keywords in the page body.                  | `allintext:"hacking tutorial"`                  |
| `filetype:`   | Finds specific file types (PDFs, DOCs, XLS, etc.).                | `filetype:pdf "SQL Injection guide"`            |
| `site:`       | Limits search results to a specific website.                      | `site:example.com "password"`                   |
| `inanchor:`   | Searches for keywords within anchor text (hyperlink text).        | `inanchor:"click here"`                         |
| `link:`       | Finds pages that link to a specific URL. *(Deprecated by Google)* | `link:example.com`                              |
| `cache:`      | Retrieves Google’s cached version of a page.                      | `cache:example.com`                             |
| `related:`    | Finds sites similar to a given domain.                            | `related:example.com`                           |
| `info:`       | Displays information about a website.                             | `info:example.com`                              |

### Common Google Dorks List

| **Dork**                                               | **Description**                                              |
| ------------------------------------------------------ | ------------------------------------------------------------ |
| `intitle:"Index of /"`                                 | Finds open directories.                                      |
| `inurl:"/admin"`                                       | Searches for admin login pages.                              |
| `inurl:"php?id="`                                      | Identifies potential SQL injection points.                   |
| `intext:"sql syntax near"`                             | Detects SQL error messages for injection testing.            |
| `ext:log`                                              | Searches for log files.                                      |
| `ext:sql` OR `ext:db` OR `ext:mdb`                     | Finds database files.                                        |
| `filetype:env "DB_PASSWORD"`                           | Looks for exposed `.env` files with credentials.             |
| `filetype:conf "password"`                             | Searches for configuration files containing sensitive data.  |
| `site:example.com filetype:pdf`                        | Finds PDFs from a specific website.                          |
| `site:example.com inurl:login`                         | Searches for login pages on a specific domain.               |
| `site:example.com -www`                                | Finds subdomains of a target website.                        |
| `"Confidential" "not for distribution"`                | Searches for leaked confidential documents.                  |
| `intitle:"WebcamXP 5"`                                 | Finds open webcams.                                          |
| `inurl:"wp-content/uploads/"`                          | Searches for exposed WordPress media files.                  |
| `inurl:".git"` OR `inurl:".svn"`                       | Looks for exposed Git or SVN repositories.                   |
| `inurl:"/wp-json/wp/v2/users"`                         | Enumerates WordPress users.                                  |
| `"Index of /" "database.sql"`                          | Finds dumped SQL databases.                                  |
| `intitle:"phpMyAdmin" "Welcome to phpMyAdmin"`         | Finds phpMyAdmin login panels.                               |
| `inurl:"/cgi-bin/"`                                    | Searches for exposed CGI scripts.                            |
| `inurl:"server-status"`                                | Checks for Apache server status pages.                       |
| `inurl:"phpinfo.php"`                                  | Finds exposed PHP configuration pages.                       |
| `inurl:".htpasswd"`                                    | Searches for `.htpasswd` authentication files.               |
| `inurl:".htaccess"`                                    | Finds `.htaccess` files, which may contain sensitive info.   |
| `ext:bkf OR ext:bkp OR ext:bak OR ext:old`             | Searches for backup files.                                   |
| `ext:doc OR ext:docx OR ext:xls OR ext:csv "password"` | Looks for documents containing passwords.                    |
| `intitle:"Dashboard" AND inurl:"dashboard"`            | Finds admin dashboards.                                      |
| `"password" filetype:xls OR filetype:csv`              | Searches for spreadsheets containing passwords.              |
| `"Your password is"`                                   | Searches for plaintext passwords exposed in web pages.       |
| `filetype:sql "phpMyAdmin SQL Dump"`                   | Finds database dumps.                                        |
| `filetype:txt "username" "password"`                   | Finds plaintext credentials in text files.                   |
| `site:example.com ext:xml`                             | Searches for XML files on a specific site.                   |
| `inurl:wp-config.php`                                  | Finds WordPress configuration files.                         |
| `inurl:env OR intext:DB_PASSWORD`                      | Searches for exposed `.env` files with database credentials. |

### Reference

{% embed url="<https://github.com/InfoSecWarrior/Offensive-Recon/blob/main/Google_Dorks.md>" %}

{% embed url="<https://www.exploit-db.com/google-hacking-database>" %}