GOOGLE DORKING CHEATSHEET
Find what others can't. Master the art of Google Hacking Database (GHDB) queries to passively uncover exposed configuration files, open directory backups, hardcoded API secrets, database dumps, and hidden admin portals without touching the target server.
🛠️ INTERACTIVE DORK BUILDER & LAUNCHER
Live Query:
site:example.com filetype:pdf intext:confidential
01
💡 Tip: Combine operators for better & targeted results
Basic Google Dorks
Domain Scope
site:example.com
All indexed pages of a website
Target website ke sabhi indexed URLs dekhne ke liye use hota hai. Target organization ka complete attack surface map karne ka first step.
URL Path
inurl:admin
Pages with "admin" in URL
URL structure me "admin" word dhoondta hai. Administrative control panels, dashboards aur hidden management gateways target karta hai.
Page Title
intitle:login
Pages with "login" in title
Webpage ke HTML
<title> tag me "login" search karta hai. Auth portals, employee SSO gates aur user sign-in forms locate karta hai.
Body Content
intext:confidential
Pages containing specific text
Page body content ke andar exact word search karta hai. Internal memos, classified policies aur non-public data leaks capture karta hai.
File Extension
filetype:pdf
PDF files
Direct Adobe Acrobat PDF files scan karta hai. Target company ke financial audit reports, whitepapers aur leaked internal guides filter karta hai.
Word Documents
filetype:doc OR filetype:docx
Word documents
Microsoft Word files dhoondta hai. Draft agreements, internal SOPs aur confidential employee contracts dhoondne ke liye critical dork.
02
💡 Tip: Use site: with filetype for accurate results
File Discovery Dorks
Target PDF
filetype:pdf site:example.com
PDF files from a specific site
Target domain ke saare indexed PDF documents filter karta hai. Target ki internal compliance, customer invoices aur policies dhoondne me effective.
Spreadsheets
filetype:xls OR filetype:xlsx
Excel spreadsheets
Excel sheets capture karta hai. Finance balances, salary lists, vendor records aur customer databases aksar `.xlsx` me accidently leak ho jaate hain.
Presentations
filetype:ppt OR filetype:pptx
PowerPoint presentations
PowerPoint pitch decks aur technical blueprints filter karta hai. Internal server architectures aur roadmap diagrams reveal karta hai.
Plain Text
filetype:txt
Text files
Developers ke raw notes,
robots.txt, public keys, temporary bash scripts aur server logs aksar `.txt` format me expose rehte hain.
Server Logs
filetype:log
Log files
Server debug logs, Apache access logs, crash stack traces aur user request IP addresses expose karne ke liye top-tier dork.
Database Dumps
filetype:sql
SQL files (databases dumps)
Database backups aur dump files (e.g.
dump.sql, backup.sql). Inme complete tables, hashed/plaintext passwords aur user PII hota hai.
03
⚠️ Tip: Always handle sensitive data responsibly
Sensitive Information Dorks
Credentials
intext:"password" filetype:txt
Text files with passwords
Admin notes, temporary scratch files ya test credentials jo `.txt` format me server par accidentally chhoot gaye hon, unhe pinpoint karta hai.
API Tokens
intext:"api key" filetype:txt
API keys in text files
Exposed OpenAI, Stripe, AWS, SendGrid aur Google Cloud API keys search karta hai jo unauthorized cloud spending aur data extraction allow kar sakti hain.
Confidential Docs
intext:"confidential" filetype:pdf
Confidential documents
NDAs, board meeting minutes, upcoming mergers, security audit findings aur proprietary IP reports uncover karta hai.
Access Anomalies
intext:"access denied"
Pages showing access issues
WAF blocks, 403 Forbidden endpoints ya poorly configured access control mechanisms ko trace karta hai jahan authorization bypass testing possible hai.
Open Directory
"index of" / "backup"
Backup or directory listings
Web server ki misconfigured directory indexation (Apache/Nginx mod_autoindex) jisme
backup/, old/, ya .tar.gz folders direct browseable ho jate hain.
Source Config
inurl:config filetype:php
Config files (PHP)
PHP web applications ke configuration files (e.g.
config.inc.php, db_config.php) jahan database host, username aur password secrets hote hain.
04
💡 Tip: Combine operators like a pro to narrow results
Advanced Operator Dorks
Subdomain Recon
site:example.com -www
Results from specific site excluding www
Target website ke main
www host ko exclude karke hidden subdomains, dev portals, test environments (e.g. dev.example.com, vpn.example.com) discover karta hai.
SQLi Vector
inurl:php?id=
Pages with id parameter
URL me dynamic numeric/string ID parameters dhoondta hai. Bug bounty hunters iska use SQL Injection (SQLi) aur Insecure Direct Object Reference (IDOR) parameters test karne ke liye karte hain.
LFI / RFI / SSRF
inurl:"?page="
Pages with page parameter
Dynamic page include parameters search karta hai. Local File Inclusion (LFI), Remote File Inclusion (RFI) aur Server-Side Request Forgery (SSRF) attack surface pinpoint karta hai.
Directory Traversal
intitle:"index of"
Directory listing pages
Web servers jahan default
index.html missing hai aur server directory tree public kar deta hai. Isme uploaded media, source scripts aur internal zips milte hain.
Entity Correlation
related:example.com
Websites related to a domain
Google ke algorithm ke mutabiq target organization ke similar ya partner websites detect karta hai. Subsidiary aur third-party vendor supply chain audit ke liye useful.
Historical Snapshot
cache:example.com
Cached version of a site
Google ke crawler ka saved cache snapshot open karta hai. Deleted pages, defaced websites, ya recently removed sensitive information dekhne ke liye perfect.
05
💡 Tip: Great for OSINT & technology reconnaissance
User & Technology Dorks
Personnel OSINT
site:linkedin.com/in
LinkedIn user profiles
Target company ke employees, SOC analysts, software engineers aur C-suite executives ke public profiles extract karta hai social engineering profiling ke liye.
Dev Recon
site:github.com "email"
Emails in GitHub repositories
Developers ke public commit logs aur repositories me corporate email IDs (@company.com) search karta hai targeted spear phishing defense audits ke liye.
WordPress Assets
inurl:wp-content
WordPress related files
WordPress themes, vulnerable third-party plugins, aur upload directories (
wp-content/plugins/, wp-content/uploads/) ko inspect karta hai.
WP Auth
inurl:wp-login.php
WordPress login pages
WordPress admin login form locate karta hai jahan attackers default credentials aur brute-force attack vectors attempt karte hain.
Joomla CMS
inurl:joomla
Joomla powered sites
Joomla CMS architecture search karta hai. Joomla administrator login endpoints (
/administrator/) aur components detect karta hai.
Database UI
inurl:phpmyadmin
phpMyAdmin login pages
Web-based MySQL administration interface exposure. Agar publicly accessible ho to attackers default root credentials test karke direct database takeover kar sakte hain.
★
🎯 Pro Recon Combinations
Bonus: Powerful Combinations
Confidential PDFs
site:example.com filetype:pdf intext:confidential
Confidential PDFs from a site
Domain, filetype aur content keyword ka powerful mix. Target organization ke internal confidential documents specifically extract karta hai.
Admin Logins
inurl:admin intitle:login
Admin login pages
URL aur Title dono me verification karta hai jisse false positives eliminate ho jate hain aur 100% accurate administrative gateways filter hote hain.
Financial Excel
site:example.com filetype:xls intext:budget
Budget spreadsheets
Target company ke internal department budgets, expenses, vendor bills aur payroll spreadsheets directly target karta hai.
Password Leaks
inurl:config filetype:php intext:password
Config files with passwords
Aisi PHP configuration files jinka execution server par fail ho gaya aur unka raw text source code expose ho gaya jisme DB passwords leak ho gaye.
Multi-Doc Audit
site:example.com (filetype:pdf OR filetype:docx)
PDFs or Word docs
Parenthesis boolean logic use karke ek hi scan me target site ke sabhi document formats (PDF aur DOCX) ko aggregate karke display karta hai.
Backup Directories
intitle:"index of" (backup OR old)
Backup directories
Exposed directory listings jinke naam me
backup ya old hai. Inme aksar unpatched code versions aur database snapshots hote hain.
WP Admin Triage
site:example.com -inurl:logout inurl:wp-admin
WP admin pages (no logout)
WordPress ke
/wp-admin/ pages filter karta hai lekin logout endpoints ko subtract (-) kar deta hai taaki useless redirection links na aayein.
Related Infrastructure
related:example.com -www
Related sites (exclude www)
Target company se related sub-brands aur associated portals search karta hai jabki main WWW domain ko result set se baahar nikaal deta hai.
06
🛡️ Official Cyber Mind Space Protocol
Useful Tips & Best Practices (Ethical Code)
🎯 BE SPECIFIC
Use precise keywords and multiple chained operators for accurate results and lower noise. Broad terms flood your query with irrelevant public articles.
⚖️ STAY ETHICAL
Use Google Dorking strictly for authorized security assessments, responsible bug bounties, and educational defense. Unauthorized exploitation of leaked secrets is illegal under international law.
🔀 COMBINE OPERATORS
Combine multiple operators (e.g., site: + filetype: + intext: + -inurl:) to refine your search from 50,000 messy hits down to 5 critical target endpoints.
🔍 VERIFY RESULTS
Always verify information against current scope before taking action. Google cache might show historical artifacts that have already been remediated or rotated.
🛡️ RESPECT PRIVACY
Do not misuse, download, exfiltrate, or share sensitive PII, healthcare records, or private credentials uncovered during reconnaissance. Report discovered exposures immediately via responsible disclosure.
💡 KNOWLEDGE IS POWER
"Knowledge is power. Use it responsibly. Hack the planet ethically." — Keep learning, maintain defensive integrity, and always protect digital infrastructure.