Google Dorking Guide

Google dorking is using advanced search operators to find information that is public but not meant to be easily found: exposed files, login portals, error messages and misconfigurations. The core operators are site, filetype, intitle, inurl and intext, combined to narrow results to exactly what you are looking for.

What Google dorking is

Search engines index far more than people intend to expose. Dorking uses operators to surface those pages: config files, directory listings, login panels, documents with metadata. It is passive reconnaissance, and it is powerful precisely because the target never knows.

The core operators

Combining them

Single operators are weak. Combined, they are precise:

site:example.com filetype:pdf
site:example.com inurl:admin
site:example.com intitle:"index of"
site:example.com filetype:env
site:example.com intext:"password"

What professionals look for

• Exposed configuration and environment files
• Directory listings that should be disabled
• Login and admin panels
• Documents leaking internal metadata
• Error messages revealing stack details

This feeds directly into the reconnaissance phase, alongside subdomain enumeration.

The legal line, read this

Searching is legal. Acting on what you find is where it changes. Viewing a public page is fine. Logging into an exposed panel, downloading data you are not authorised to, or using leaked credentials is a crime, even though a search engine handed you the door. Passive discovery only, unless you have written authorisation.

Defending against dorking

For defenders: a robots file does not hide anything, it just asks nicely. Real defence is not exposing the files in the first place, disabling directory listing, and keeping sensitive content behind authentication.

Practise this

Dork your own domain first. You will likely find something you did not know was exposed, which is the whole point. For structured OSINT, see the OSINT syllabus.