Google Dorking
Master advanced Google search operators to find hidden information in CTF OSINT challenges.
Google Dorking
Google Dorking (also called Google Hacking) is a passive reconnaissance technique that combines advanced search operators to uncover publicly indexed data not easily discoverable through normal searches.
How it works: Operators like site:, filetype:, inurl:, intitle:, and cache: filter Google's index to target specific files, domains, or content patterns.
Why it matters: Exposed configuration files, API documentation, credentials, and backup archives are frequently indexed and discoverable, allowing security researchers (and attackers) to identify misconfigurations without active scanning or network traffic that could be detected.
Google dorking is passive reconnaissance - you are reading publicly indexed information. Always stay within the scope defined by the CTF. Never use these techniques against systems you do not have permission to target outside of CTF contexts. The Google Hacking Database (GHDB) techniques can expose sensitive information on real systems - use responsibly.
Note: Automated scraping of search engines is often rate-limited and may violate Terms of Service. Prefer manual queries in the browser, public datasets like the GHDB, or engine APIs where available. See the checklist below for safe, low-noise workflows.
Core Search Operators
| Operator | Description | Example |
|---|---|---|
site: | Restrict to a domain | site:example.com admin |
filetype: | Search for file types | filetype:pdf confidential |
intitle: | Term in page title | intitle:"index of" passwords |
allintitle: | All terms in title | allintitle:secret admin panel |
inurl: | Term in URL | inurl:admin login |
allinurl: | All terms in URL | allinurl:admin config |
intext: | Term in body text | intext:"secret key" |
allintext: | All terms in body | allintext:flag ctf 2024 |
cache: | Google's cached copy | cache:example.com |
"exact phrase" | Exact match | "John Smith" hacker ctf |
-word | Exclude a word | flag -ctftime -writeup |
OR | Either term | admin OR administrator |
* | Wildcard | "my * is a secret" |
.. | Number range | CTF 2020..2024 |
before: | Before date | site:github.com before:2023-01-01 |
after: | After date | site:pastebin.com after:2024-01-01 |
Combining Operators
The real power comes from combining multiple operators:
# Find exposed config files on GitHub
site:github.com filetype:env "DB_PASSWORD"
site:github.com filename:.env "SECRET_KEY"
# Find open directory listings
intitle:"index of" "parent directory" filetype:txt
# Find flags in public pastes
site:pastebin.com "flag{" OR "CTF{"
site:gist.github.com "flag{"
# Find login pages of target
site:target.com inurl:login OR inurl:signin OR inurl:admin
# Find PDF documents with sensitive content
filetype:pdf site:targetorg.com "internal use only"
# Find exposed database files
filetype:sql intext:password OR intext:flag
# Find specific person across platforms
"John Doe" site:twitter.com OR site:linkedin.com OR site:github.comReal CTF Scenarios
Scenario: "Find where this person works"
# Start broad
"Target Name" LinkedIn
"Target Name" site:linkedin.com
# Cross-reference with other data
"Target Name" "company_name"
"targetusername" site:github.com emailBeyond Google: Alternative Search Engines
Best for: general web content, code repositories, documents.
| Operator | Example |
|---|---|
site: | site:example.com filetype:pdf |
cache: | cache:example.com/secret |
before:/after: | site:github.com before:2023-01-01 |
| Tool | URL | Best For |
|---|---|---|
| Shodan | shodan.io | Internet-connected devices, open ports |
| Censys | censys.io | Certificate-focused device search |
| Bing | bing.com | Different indexing than Google |
| Yandex | yandex.com | Eastern European targets, better face recognition |
| DuckDuckGo | duckduckgo.com | Privacy-respecting, different results |
| Pastebin Search | pastebin.com | Search paste sites |
| OSINT Framework | osintframework.com | Organized tool directory |
Practical Dorking Methodology
Start broad
site:target.com - How many pages are indexed? Are there any unexpected pages?
Enumerate content types
site:target.com filetype:pdf
site:target.com filetype:txt
site:target.com filetype:xlsxFind admin/interesting pages
site:target.com inurl:admin OR inurl:login OR inurl:panel
intitle:"index of" site:target.comLook for personal information
site:target.com intext:email "@"
site:target.com intext:phoneFind subdomains
site:*.target.com
-www.target.com site:*.target.com (exclude www)Check archives and caches
cache:target.com
site:web.archive.org target.comCross-platform search
"target person name" OR "target username"
Add: site:github.com OR twitter.com OR linkedin.comInfrastructure
Shodan: org:"Target" or ssl.cert.subject.cn:"*.target.com"
Tips and Ethics
Tips for efficiency:
- Use quotes for exact phrases:
"flag{searches better thanflag{ - Combine
site:withintext:for targeted content searches - Use
-to exclude irrelevant results (e.g.,-ctftime -writeupto avoid spoilers) - Try both
inurl:andintitle:for the same term - Always check the first 3–5 pages of results
Checklist
Practice
- Google Hacking Database (GHDB) - thousands of tested dorks
- DorkSearch - pre-built dork templates by category
- OSINT Framework - comprehensive tool tree
Last updated on