Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Tutorial

What Is Google Dorking?

Dimitris Gkoutzamanis

3 min read

Google-Hacking-Database

Update, October 2026: Google has retired the cache: and related: operators, and cached copies of pages are no longer available from Google Search. The operator list below has been updated: link:, info: and stocks:, which Google’s documentation no longer lists, have been removed, and the exact-match, exclusion and date operators it does list have been added.

For normal users, Google is the most famous search engine in the world. For those who know how to perform advanced Google searches it can also become a very useful and powerful hacking tool.

WHAT IS GOOGLE DORKING

Google Dork or Google Dorking is a great resource for security research.

It has been around since the early 2000s. It simply requires the use of certain operators, which are special keywords supported by google (or any other search engine).

In this article we are going to focus on Google Dorking because it is the best web crawler in the world at the moment.

It leverages Google’s indexing capabilities to list all resources in a website including private information. A robots.txt file only asks crawlers not to fetch pages, and the file itself is public. To keep a resource out of search results use a noindex directive, and for anything sensitive require authentication or remove it from the web server.

In simple terms, google dorking is advanced google search queries.

HOW TO USE IT

There are resources online which have many queries ready for you to use so you don’t need to think of any by yourself.

One of the best resources is GHDB. The Google Hacking Database or “GHDB”, started by Johnny Long and maintained by OffSec on Exploit-DB since 2010, lists search terms or “Dorks”.

You can search through the GHDB here

The entries are categorized and you can quickly search for a Dork you may already have in mind.

The GHDB categories are:

  1. Footholds
  2. Files containing usernames
  3. Sensitive directories
  4. Web server detection
  5. Vulnerable files
  6. Vulnerable servers
  7. Error messages
  8. Files containing juicy info
  9. Files containing passwords
  10. Sensitive online shopping info
  11. Network or vulnerability data
  12. Pages containing login portals
  13. Various online devices
  14. Advisories and vulnerabilities

COMMON SEARCH OPERATORS

Below is a list of commonly used keywords and their explanation:

define: The query [define:] will provide a definition of the words you enter after it, gathered from various online sources. The definition will be for the entire phrase entered (i.e., it will include all the words in the exact order you typed them).

site: If you include [site:] in your query, Google will restrict the results to those websites in the given domain.

For instance, [help site:www.google.com] will find pages about help within www.google.com. [help site:com] will find pages about help within .com urls. Note there can be no space between the “site:” and the domain.

allintitle: If you start a query with [allintitle:], Google will restrict the results to those with all of the query words in the title.

For instance,[allintitle: google search] will return only documents that have both “google” and “search” in the title.

intitle: If you include [intitle:] in your query, Google will restrict the results
to documents containing that word in the title. For instance, [intitle:google search] will return documents that mention the word “google” in their title, and mention the word “search” anywhere in the document (title or no). Note there can be no space between the “intitle:” and the following word. Putting [intitle:] in front of every word in your query is equivalent to putting [allintitle:] at the front of your query: [intitle:google intitle:search] is the same as [allintitle: google search].

allinurl:
If you start a query with [allinurl:], Google will restrict the results to
those with all of the query words in the url.

For instance, [allinurl: google search]will return only documents that have both “google” and “search” in the url. Note that [allinurl:] works on words, not url components. In particular, it ignores punctuation. Thus, [allinurl: foo/bar] will restrict the results to page with the words “foo” and “bar” in the url, but won’t require that they be separated by a slash within that url, that they be adjacent, or that they be in that particular word order. There is currently no way to enforce these constraints.

inurl: If you include [inurl:] in your query, Google will restrict the results to documents containing that word in the url.

For instance, [inurl:google search] will return documents that mention the word “google” in their url, and mention the word “search” anywhere in the document (url or no). Note there can be no space between the “inurl:” and the following word. Putting “inurl:” in front of every word in your query is equivalent to putting “allinurl:” at the front of your query: [inurl:google inurl:search] is the same as [allinurl: google search].

filetype: If you include [filetype:pdf] with your Google search, you will get PDF documents as results. You can use this keyword with many other filetypes like: docx,xlsx,txt and so on.

"": Putting a word or phrase inside quotes searches for that exact word or phrase.

-: Putting [-] in front of a word excludes results that contain it. For instance, [jaguar speed -car] leaves out pages about the car.

before: and after: If you include [before:] or [after:] with a year or date, Google will restrict the results to documents last updated before or after it. For instance, [avengers endgame before:2019] or [avengers endgame after:2020].

GOOGLE DORKING FOR DEFENSE

Google Dorking is great for penetration testing activities and security researching but can also be used to aid in the protection of sensitive information.

You can lookup information on services you or your company owns and administers, like FTP and Web servers as well as information about yourself, a company’s employees and data related to them which may potentially be exposed.

A simple process to use when checking for potential data leak of sensitive information is the following:

  1. [Your Name] filetype:pdf Do the same search for other file types like doc, docx, xlsx, xls, txt and so on
  2. [Your Name] intext:[personal information like ID, Phone number etc]
  3. site:[Your Websites Address] filetype:pdf (or any other filetype)

You can use the GHDB on Exploit-DB to perform more advanced queries as you go on with your research.

Correction, 26 October 2026: this article said adding resources to robots.txt is the only way to keep them from being indexed, but robots.txt only controls crawling and is itself public, so use noindex or authentication instead; and it said Offensive Security created the Google Hacking Database, but Johnny Long started it and handed it to OffSec in 2010.