Google Dorking for Security Testing: From Basics to Advanced

Introduction

Google Dorking (also known as Google Hacking) is the practice of using advanced search operators in Google to find specific information not easily accessible through normal search queries. In the context of security testing, ethical hackers use Google Dorking to identify publicly exposed sensitive information, misconfigured web servers, and insecure files.

⚠ Legal Disclaimer Google Dorking must only be used on systems and data you are authorized to test. Unauthorized access or exploitation of data is illegal and may lead to prosecution under cybercrime laws.

---

1. Basics of Google Dorking

Before we dive into security payloads, here are the core search operators:

Operator	Description	Example
site:	Search within a specific site or domain	site:example.com
filetype:	Search for specific file types	filetype:pdf
intitle:	Search within page titles	intitle:"login"
inurl:	Search within URLs	inurl:"admin"
cache:	View Google’s cached version of a site	cache:example.com
"..."	Exact match search	"confidential report"
OR	Search for either of multiple terms	"login" OR "signin"

---

2. Basic Security Testing Dorks

These are commonly used to identify publicly accessible sensitive pages.

Login portals

inurl:"/admin/login" site:target.com
intitle:"admin login" site:target.com

Index pages revealing files

intitle:"index of /" site:target.com

Open directory listings

"Index of /" +password site:target.com

Publicly exposed documents

filetype:pdf site:target.com confidential
filetype:xls site:target.com password

Config or backup files

ext:cfg OR ext:conf OR ext:bak OR ext:ini site:target.com

---

3. Intermediate Security Testing Dorks

These dorks help find misconfigurations, vulnerable endpoints, and source code leaks.

Database dumps

ext:sql OR ext:db site:target.com

Environment configuration files

ext:env site:target.com

Public Git repositories

inurl:.git site:target.com

Error logs

ext:log site:target.com "error"

API keys in JS files

site:target.com filetype:js "api_key"

Exposed WordPress admin panels

inurl:wp-admin site:target.com

Search for exposed phpMyAdmin

intitle:"phpMyAdmin" "Welcome to phpMyAdmin" site:target.com

---

4. Advanced Security Testing Dorks

These are high-value bug bounty style dorks that can help identify vulnerable assets.

AWS keys exposure in code

site:target.com filetype:env "AWS_SECRET_ACCESS_KEY"

Jenkins dashboards without authentication

intitle:"Dashboard [Jenkins]" site:target.com

Jira project pages (could reveal internal issues)

inurl:"/jira/secure/" site:target.com

Kubernetes dashboard

intitle:"Kubernetes Dashboard" inurl:/#!/login site:target.com

GitLab public projects

intitle:"Sign in · GitLab" site:target.com

Publicly exposed camera feeds

inurl:"view.shtml" OR inurl:"video.mjpg" site:target.com

Payment gateway test environments

intitle:"payment" "test environment" site:target.com

Directory traversal vulnerable endpoints

inurl:"../" site:target.com

Finding Login Panels

site:*<*.target.com intext:"login" | intitle:"login" | inurl:"login" | intext:"username" | intitle:"username" | inurl:"username" | intext:"password" | intitle:"password" |…

Finding API docs

inurl:apidocs | inurl:api-docs | inurl:swagger | inurl:api-explorer site:"target.com"

Finding API Endpoints

site:target.com inurl:api | site:*/rest | site:*/v1 | site:*/v2 | site:*/v3

Third Party Dorking

site:http://ideone.com | site:http://codebeautify.org | site:http://codeshare.io | site:http://codepen.io | site:http://repl.it | site:http://justpaste.it | site:http://pastebin.com | site:http://jsfiddle.net | site:http://trello.com | site:*.atlassian.net | site:bitbucket.org "target.com"

---