Passive Reconnaissance: Google Dorking

Google Dorking (also called Google Hacking) uses advanced Google search operators to find sensitive information, security vulnerabilities, misconfigurations, and exposed data that shouldn't be public. By crafting precise search queries, you can discover admin panels, exposed databases, confidential documents, passwords, and much more—all through Google's index.

What You'll Learn

What Google Dorking is and why it works
Advanced Google search operators
Finding sensitive files and directories
Discovering vulnerable web applications
Locating exposed credentials and databases
Using the Google Hacking Database (GHDB)
Automating Google dorking
Defensive measures against exposure

What Is Google Dorking?

The Concept:

Google indexes BILLIONS of web pages

Many contain:
✗ Sensitive files (passwords, configs)
✗ Vulnerable applications
✗ Admin login pages
✗ Database dumps
✗ Confidential documents
✗ Personal information

Google Dorking = Using search operators to find them

Why It Works:

Common mistakes:
1. Accidentally public directories
2. Default installations not secured
3. Misconfigured servers
4. Forgotten test pages
5. No robots.txt restrictions
6. Sensitive files in web root

Google finds everything → You use advanced operators

Advanced Google Search Operators

Basic Operators:

site:         Restrict to specific domain
filetype:     Find specific file types
inurl:        Search within URLs
intitle:      Search within page titles
intext:       Search within page body text
cache:        View Google's cached version
link:         Find pages linking to URL (limited now)
related:      Find similar sites

Combination Techniques:

Operators can be combined:

site:example.com filetype:pdf
= PDFs only on example.com

intitle:"index of" site:edu
= Directory listings on .edu domains

inurl:admin site:example.com
= Admin pages on example.com

Finding Sensitive Files

Configuration Files:

filetype:env "DB_PASSWORD"
= .env files with database passwords

filetype:config inurl:web.config
= ASP.NET configuration files

filetype:xml intext:"connection string"
= Database connection strings

filetype:ini intext:"password"
= .ini configuration files with passwords

site:github.com "aws_access_key_id"
= AWS credentials on GitHub

Backup Files:

filetype:bak inurl:backup
= Backup files

filetype:sql intext:"INSERT INTO" intext:"VALUES"
= SQL database dumps

filetype:old inurl:index.old
= Old versions of files

intitle:"Index of" intext:backup
= Backup directories

Log Files:

filetype:log intext:"password"
= Logs containing passwords

filetype:log inurl:access.log
= Web server access logs

filetype:log intext:"username"
= Authentication logs

Sensitive Documents:

site:example.com filetype:pdf confidential
= Confidential PDFs

filetype:xls inurl:password
= Excel files with passwords

filetype:docx "salary" OR "confidential"
= Confidential Word documents

site:s3.amazonaws.com filetype:pdf
= PDFs on exposed S3 buckets

Discovering Vulnerable Applications

intitle:"Login" inurl:admin
= Admin login pages

inurl:wp-admin site:example.com
= WordPress admin panels

inurl:/phpmyadmin/
= phpMyAdmin interfaces

intitle:"Dashboard" inurl:login
= Various dashboard logins

inurl:"/cgi-bin/login.cgi"
= CGI login pages

Default Pages:

intitle:"Apache2 Ubuntu Default Page"
= Default Apache installations

intitle:"Welcome to nginx!"
= Default nginx installations

intitle:"IIS Windows Server"
= Default IIS pages

intitle:"Test Page for the Apache"
= Test installations

Web Shells:

inurl:shell.php
= PHP web shells

intitle:"WSO" intext:"Web Shell"
= WSO web shell

inurl:c99.php
= c99 shell

filetype:php intext:"uname -a"
= PHP shells with system commands

Vulnerable Applications:

inurl:/admin/login.php "powered by"
= Admin panels with software version

intitle:"index of" "phpMyAdmin"
= Exposed phpMyAdmin installations

inurl:"/cgi-bin/" intext:"Server at"
= CGI directories (potential Shellshock)

inurl:wp-content/plugins/ site:example.com
= WordPress plugins (check for vulnerabilities)

Exposed Databases and Credentials

Database Interfaces:

inurl:"/phpmyadmin/index.php"
= phpMyAdmin login

intitle:"MongoDB" intext:"replica set"
= MongoDB admin interfaces

inurl:":9200/_plugin/head/" 
= Elasticsearch head plugin

inurl:":27017" intitle:"MongoDB"
= Exposed MongoDB instances

Credential Leaks:

filetype:env "DB_PASSWORD"
filetype:env "API_KEY"
filetype:env "SECRET"

= Environment files with credentials

site:pastebin.com "password" site:example.com
= Leaked passwords on Pastebin

site:github.com "password" user:target
= Credentials in GitHub repos

intext:"index of /" "credentials.txt"
= Exposed credential files

API Keys:

filetype:json "api_key"
= API keys in JSON files

site:github.com "AKIA" 
= AWS access keys (start with AKIA)

intext:"sk_live_" site:github.com
= Stripe API keys

"AIza" site:github.com
= Google API keys

Directory Listings

Finding Open Directories:

intitle:"index of /"
= Any directory listing

intitle:"index of /" "parent directory"
= Classic directory listings

intitle:"index of" "backup"
= Backup directories

intitle:"index of" "password"
= Directories with password files

intitle:"index of" "/admin"
= Admin directories

Specific Content:

intitle:"index of" "database.sql"
= SQL dumps

intitle:"index of" ".git"
= Exposed Git repositories

intitle:"index of" ".env"
= Environment files

intitle:"index of" "id_rsa"
= SSH private keys

Exposed Cameras and Devices

IP Cameras:

inurl:"/view/viewer_index.shtml"
= Panasonic cameras

inurl:"/ViewerFrame?Mode="
= Axis cameras

intitle:"Live View / - AXIS"
= Axis camera live view

inurl:":8080/view/index.shtml"
= Generic webcams

intitle:"webcamXP 5"
= WebcamXP software

Network Devices:

intitle:"DD-WRT" "Status_Router.asp"
= DD-WRT routers

intitle:"pfSense" inurl:"status_interfaces.php"
= pfSense firewalls

inurl:":8080/login.htm" "Linksys"
= Linksys routers

intitle:"Network Camera" inurl:ViewerFrame
= Network cameras

IoT Devices:

intitle:"Dashboard" inurl:"app/kibana"
= Kibana dashboards

intitle:"Grafana" inurl:":3000"
= Grafana monitoring

intitle:"Home Assistant" inurl:":8123"
= Home automation

The Google Hacking Database (GHDB)

What Is It:

URL: https://www.exploit-db.com/google-hacking-database

Repository of Google dorks
Categorized by type:
- Footholds
- Files containing usernames
- Sensitive directories
- Web server detection
- Vulnerable files
- Vulnerable servers
- Error messages
- Files containing juicy info
- Passwords
- Network/vulnerability data

How to Use:

1. Browse categories on GHDB
2. Find relevant dork
3. Copy search query
4. Paste into Google
5. Add your target domain with site:

Example GHDB entry:
filetype:env "DB_PASSWORD"

Your usage:
filetype:env "DB_PASSWORD" site:targetcompany.com

Popular GHDB Dorks:

Footholds:
intitle:"index of" "parent directory"
inurl:/cgi-bin/ "Index of /cgi-bin"

Sensitive Directories:
intitle:"index of" "database"
intitle:"index of" "backup"

Login Portals:
intitle:"Login" inurl:admin
inurl:wp-admin

Passwords:
filetype:sql "password" | "pass" | "passwd"
filetype:txt "password"

Documents:
filetype:pdf "confidential"
filetype:xls "password"

Automating Google Dorking

Command-Line (curl + jq):

#!/bin/bash
# Note: Google blocks automated queries, use carefully

DOMAIN="example.com"
DORK="filetype:pdf site:${DOMAIN}"

# Use Custom Search JSON API (requires API key)
API_KEY="YOUR_KEY"
CX="YOUR_CX"

curl "https://www.googleapis.com/customsearch/v1?key=${API_KEY}&cx=${CX}&q=${DORK}" | jq .

Python with googlesearch-python:

from googlesearch import search

# Basic search
dork = "site:example.com filetype:pdf confidential"

for result in search(dork, num_results=10):
    print(result)

# Multiple dorks
dorks = [
    "site:example.com filetype:env",
    "site:example.com intitle:index.of",
    "site:example.com inurl:admin"
]

for dork in dorks:
    print(f"\n[*] Searching: {dork}")
    for url in search(dork, num_results=5):
        print(f"  [+] {url}")

Installation:

pip install googlesearch-python

Important Note on Automation:

⚠️ Google Rate Limits:
- Too many queries = temporary ban
- Use with caution
- Spread out requests
- Consider proxies (but be ethical)

Alternative:
- Use Google Custom Search API (1000 free queries/day)
- Requires API key
- More reliable than scraping

Defensive Measures

For Website Owners:

1. robots.txt:

# /robots.txt

User-agent: *
Disallow: /admin/
Disallow: /backup/
Disallow: /config/
Disallow: /logs/
Disallow: /.git/

2. Remove Sensitive Files:

# Find common sensitive files
find /var/www/html -name "*.bak"
find /var/www/html -name "*.old"
find /var/www/html -name ".env"
find /var/www/html -name "config.php.bak"

# Remove them!
rm /var/www/html/backup.sql
rm /var/www/html/.env.bak

3. Directory Listing Disable:

# Apache .htaccess
Options -Indexes

# Or in httpd.conf
<Directory /var/www/html>
    Options -Indexes
</Directory>

# Nginx
location / {
    autoindex off;
}

4. Block Specific Files:

# Apache .htaccess
<FilesMatch "\.(env|bak|old|sql|log|config)$">
    Require all denied
</FilesMatch>

# Nginx
location ~ \.(env|bak|old|sql|log|config)$ {
    deny all;
}

5. Authentication:

Protect admin areas:
- Use strong authentication
- Implement IP restrictions
- Enable 2FA
- Don't use default URLs (/admin, /administrator)

Google Search Console:

Use Google Search Console to:
1. See what Google has indexed
2. Request removal of sensitive URLs
3. Identify security issues
4. Monitor indexing status

URL: https://search.google.com/search-console

Check Your Exposure:

Test your own site:
site:yourwebsite.com filetype:env
site:yourwebsite.com intitle:"index of"
site:yourwebsite.com inurl:backup
site:yourwebsite.com filetype:sql
site:yourwebsite.com "password"

Fix anything you find!

Legal and Ethical Considerations

Legal:

✓ Searching Google is legal
✓ Viewing public information is legal
✓ Security research (authorized)

✗ Unauthorized access = illegal
✗ Using found credentials = illegal (usually)
✗ Exploiting vulnerabilities without permission = illegal

Ethical:

✓ Defensive dorking (check your own sites)
✓ Responsible disclosure of findings
✓ Educational purposes
✓ Authorized penetration testing

✗ Exploiting found data
✗ Selling credentials
✗ Unauthorized access
✗ Malicious intent

Responsible Disclosure:

If you find sensitive exposure:
1. Document (screenshot, URL, date)
2. Notify site owner privately
3. Give time to fix (e.g., 90 days)
4. Don't exploit or publicize immediately

Contact methods:
- [email protected]
- Abuse contact from WHOIS
- HackerOne/Bugcrowd (if they have program)

Try It Yourself

Exercise 1: Basic Dorking

Search for:
1. site:.gov filetype:pdf
   - Government PDFs

2. intitle:"index of" "parent directory"
   - Directory listings

3. inurl:login site:.edu
   - Educational institution logins

Note: Only view, don't access or exploit!

Exercise 2: Target Reconnaissance

Pick a target (with authorization!):
1. site:targetdomain.com filetype:pdf
2. site:targetdomain.com intitle:"index of"
3. site:targetdomain.com inurl:admin
4. site:targetdomain.com filetype:env

Document findings for your report.

Exercise 3: Check Your Own Site

If you have a website:
1. site:yourdomain.com filetype:bak
2. site:yourdomain.com intitle:"index of"
3. site:yourdomain.com inurl:.env
4. site:yourdomain.com filetype:sql

Find anything? Fix it!

Exercise 4: GHDB Exploration

1. Go to https://www.exploit-db.com/google-hacking-database
2. Browse categories
3. Try 5 different dorks
4. Note what types of information each reveals

Quick Reference

Common Operators:
site:        domain restriction
filetype:    file type
inurl:       URL contains
intitle:     title contains
intext:      body text contains
cache:       Google's cache

Useful Combinations:
site:target.com filetype:pdf
intitle:"index of" site:target.com
inurl:admin site:target.com
filetype:env "PASSWORD" site:target.com

GHDB:
https://www.exploit-db.com/google-hacking-database

Google CSE API:
https://developers.google.com/custom-search

Resources

Google Dork Databases:

Google Hacking Database (GHDB): https://www.exploit-db.com/google-hacking-database
Google Dork List: Various GitHub repos with dork collections

Tools:

googlesearch-python: pip install googlesearch-python
Pagodo: Automated GHDB dork runner
GooFuzz: Google dorking tool
GooDork: Google dorking from CLI

Reading:

Google Hacking for Penetration Testers by Johnny Long
Google Search Operators - Official guide
OSINT Framework - Search Engines section

APIs:

Google Custom Search JSON API: 100 free searches/day, then paid
SerpApi: Third-party Google scraping API

Next Steps

Explore the GHDB and learn common dorks
Test your own websites for exposure
Automate dorking with Python scripts
Integrate with other OSINT tools
Practice responsible disclosure if you find vulnerabilities

Google Dorking is one of the most powerful OSINT techniques. Master it, but use it ethically!

"With great Google dorking power comes great responsibility. Don't be evil."