Google Dorking is an OSINT technique that involves using advanced Google search operators to find specific information that would be harder to locate with a regular search. It is used in cybersecurity for web application reconnaissance, researching publicly available information, and identifying potential accidental data exposures.
| Operator | Purpose |
|---|---|
site: | Restricts the search to a specific domain or website |
inurl: | Searches for terms in the URL |
intitle: | Searches for terms in the page title |
intext: | Searches for terms in the page content |
filetype: | Filters results by file type |
ext: | Filters results by file extension |
"phrase" | Searches for an exact phrase ("Index of /") |
-term | Excludes a term (site:example.com -www) |
OR | Searches for one term or another |
* | Wildcard that replaces words in a phrase |
Examples
Finding subdomains:
site:*.example.comExclude the main www subdomain:
site:example.com -wwwFinding API endpoints:
site:example.com inurl:apiAPI documentation:
site:example.com (inurl:swagger OR inurl:api-docs OR inurl:openapi)Finding exposed files
Look for configuration-related files:
site:example.com (filetype:yaml OR filetype:yml OR filetype:conf)
Backup-like filenames:
site:example.com (inurl:backup OR inurl:old OR inurl:bak)
Finding directory listings
site:example.com intitle:"Index of /"