Search Engine Dorking

Learning Objectives

• After this, students can build precise search queries using operators instead of plain keywords.
• After this, students can combine operators into “dorks” that surface specific file types, pages, and exposures on a domain they are authorized to assess.
• After this, students can explain which classic operators still work in 2026 and which have been retired.
• After this, students can use the Google Hacking Database (GHDB) responsibly and describe the limits search engines put on automated querying.

Why Dorking Matters

“Google dorking” (also called Google hacking) means using a search engine’s advanced operators to find information that ordinary keyword searches bury or miss. Nothing about it breaks into anything: you are only asking a public search index better questions. The power comes from precision. A search for companyx budget returns millions of loosely related pages; a search for site:companyx.com filetype:xlsx budget returns only spreadsheets that Company X published on its own website with “budget” in them. That is the difference between browsing and collection.

Dorking is the workhorse of the collection phase (see methodology in Module 3). Almost every other technique in this module — finding documents to pull metadata from, locating login portals, discovering paste-site leaks — starts with a well-built query.

A note on scope before we start: the recipes below are framed for a domain you own or are authorized to test (we will use companyx.com and example.com as stand-ins). Finding an exposed file is passive and legal; downloading sensitive data you have no authorization to access is not. This ties directly back to Module 2 (Legal & Ethical Boundaries).

Core Google Operators (working in 2026)

Google officially documents only a handful of operators, but several long-standing ones still work reliably. The table below separates what Google documents from what still works in practice.

site: and filetype: are the two you will use most. filetype: and ext: behave almost identically; ext: is sometimes more literal about the extension.

Operators that have been retired — don’t rely on them

Search engines change constantly, and several operators students will see in old tutorials no longer work:

• cache: — Removed. Google’s SearchLiaison announced its removal in early 2024 and now points users to the Internet Archive instead. To see an old version of a page, use the Wayback Machine (covered in 4.5-infrastructure-recon.md), not cache:.
• related: — No longer functional (dropped around mid-2023).
• info:, link:, +, ~ — All retired or quietly broken; avoid them.
• num=100 URL trick — In September 2025 Google silently disabled the num=100 URL parameter, so you can no longer force 100 results per page. Plan for ~10 results per page and paginate.

If a query behaves strangely, test whether an operator has been deprecated before you assume the target has nothing to find.

Bing Operators

Bing is worth running in parallel because it keeps a separate index (different results) and supports a couple of operators Google never had. Bing defaults every search to AND logic, and NOT/OR must be capitalized or Bing treats them as ordinary words. Only the first 10 search terms are processed.

Bing’s ip: operator is the standout for infrastructure work — it can reveal virtual hosts sharing an IP, which Google cannot do.

Other engines to keep in rotation (covered as sources in Module 5): DuckDuckGo (draws largely on Bing), Yandex (strong reverse image search), Baidu (Chinese-language content), and independent indexes like Mojeek and Brave Search that sometimes surface pages the big engines drop.

Building a Dork Step by Step

Think of a dork as a funnel. Start broad, then add one constraint at a time and watch what drops out.

1. Anchor to the target. site:companyx.com
2. Add a content type. site:companyx.com filetype:pdf
3. Add a topic keyword. site:companyx.com filetype:pdf intext:confidential
4. Exclude noise. site:companyx.com filetype:pdf intext:confidential -template
5. Bound the time window if it helps. site:companyx.com filetype:pdf intext:confidential after:2024-01-01

Add constraints one at a time so you understand which one changed the results. If a query returns nothing, remove your most recent constraint rather than rewriting the whole thing.

Dork Recipes by Goal

Framed for companyx.com, a domain you are authorized to assess. Swap in your own domain in the lab.

Find published documents (for metadata analysis — see 4.4-document-metadata.md)

site:companyx.com filetype:pdf
site:companyx.com (filetype:doc OR filetype:docx OR filetype:xlsx OR filetype:pptx)

Find directory listings (misconfigured servers that list their files)

site:companyx.com intitle:"index of"
intitle:"index of" "parent directory" site:companyx.com

Find login and admin portals (map the authentication surface)

site:companyx.com inurl:login
site:companyx.com (inurl:admin OR inurl:portal OR intitle:"sign in")

Find exposed config / backup files (common leak types)

site:companyx.com (ext:env OR ext:ini OR ext:conf OR ext:bak OR ext:sql)
site:companyx.com filetype:log

Find code and credentials leaked off-site (paste sites, repos)

"companyx.com" (site:pastebin.com OR site:gist.github.com)
"companyx.com" "password" site:pastebin.com

Find subdomains a search engine already knows about

site:*.companyx.com -site:www.companyx.com

If any recipe reveals something genuinely sensitive on a domain you do not control, stop and report it responsibly — do not open or download it. This is the “stumble on something exposed” case from Module 2.

The Google Hacking Database (GHDB)

You do not have to invent every dork yourself. The Google Hacking Database, hosted by OffSec on Exploit-DB, is a categorized, community-maintained library of proven dorks. It was popularized by Johnny Long around 2000 and has been maintained by OffSec since 2010.

Its categories include:

• Footholds
• Files Containing Usernames
• Sensitive Directories
• Web Server Detection
• Vulnerable Files
• Vulnerable Servers
• Error Messages
• Files Containing Juicy Info
• Files Containing Passwords
• Sensitive Online Shopping Info
• Network or Vulnerability Data
• Pages Containing Login Portals
• Various Online Devices
• Advisories and Vulnerabilities

Use the GHDB as a source of patterns. Copy a dork, then add site:companyx.com to scope it to your authorized target rather than searching the entire internet — running a raw “files containing passwords” dork against the whole web can surface other people’s live secrets, which drags you straight into the legal issues from Module 2.

Limits and Gotchas

• CAPTCHAs and rate limits. Fire off many rapid-fire dorks and Google will show a CAPTCHA or temporarily block you. Slow down, and never point a scraper at Google — since January 2025 Google Search requires JavaScript specifically to block scrapers and SEO tools.
• No more raw APIs. The old Bing Search API was retired on 11 August 2025 (keys now return HTTP 410). Google’s Custom Search JSON API was closed to new customers and is scheduled to shut down on 1 January 2027. There is no clean, free, official “search API” to automate against anymore — dorking is largely a manual, browser-based skill in 2026.
• Personalization. Your results are shaped by your location, language, and history. For repeatable OSINT, search in a clean browser profile or private window (this also supports OPSEC — Module 8). Try country-specific versions (e.g. google.de) for regional content.
• Indexing lag. Search engines show what they have crawled, which may be stale or incomplete. Something absent from Google may still exist — cross-check with Bing, other engines, and the Wayback Machine.
• Coverage differs by engine. Always run important queries on at least two engines; their indexes genuinely differ.

Key Terms

• Dork / Google dork: an advanced search query using operators to find specific, often overlooked, information.
• Operator: a special keyword (like site: or filetype:) that constrains how a search engine matches your query.
• GHDB (Google Hacking Database): OffSec’s categorized library of useful dorks on Exploit-DB.
• Directory listing: a web page auto-generated by a misconfigured server that lists the files in a folder (often titled “Index of /”).

Key Takeaways

• Dorking is asking a public index better questions — it is passive and legal; what you do with a find may not be.
• site: + filetype: is the backbone of almost every collection query.
• cache:, related:, info:, link:, and + are all dead in 2026 — use the Wayback Machine instead of cache:.
• Bing’s ip: operator finds other sites on the same host; Google can’t do that.
• Scope GHDB dorks to your authorized target with site: — never run “password” dorks against the whole web.
• The free Google and Bing search APIs are gone (Bing retired Aug 2025; Google CSE ends Jan 2027) — dorking is now a manual skill.

References

• Refine web searches — Google Help
• Google Removes Cache: Search Operator Documentation — Search Engine Journal
• Advanced search options — Microsoft Support
• Bing Search Operators Cheatsheet — Provereno-Media (GitHub)
• Confirmed: Google Is Requiring JavaScript To Block SEO Tools — Search Engine Journal
• Bing Search APIs Retiring on August 11, 2025 — Microsoft Learn
• Custom Search JSON API overview — Google for Developers
• Google Kills Custom Search API on Jan 1, 2027 — DEV Community
• Google Hacking Database — Exploit-DB