Footprinting & Reconnaissance · Module 02
Google Dorking
Use advanced Google search operators to find exposed files, logins and pages.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
Google Dorking is an information-gathering technique that uses advanced search operators to find specific information indexed by Google.
Narrow search results to locate publicly indexed pages, documents, directories, and technical information.
OSINT, security assessments, digital investigations, and exposure discovery.
Key features
Filters results using specific operators.
Finds indexed files of a particular type.
Searches for pages with specific words in the URL.
Finds pages with specific terms in the HTML title.
Restricts results to a particular website or domain.
Important commands & actions
site:example.comRestrict results to a domain.
filetype:pdfSearch for PDF files.
intitle:loginFind pages with a term in the title.
inurl:adminFind URLs containing a term.
intext:securitySearch page content for a term.
"exact phrase"Search for an exact phrase.
-keywordExclude results containing a term.
site:example.com filetype:pdfFind indexed PDFs on a specific domain.
Practical examples
site:example.com filetype:pdf
Purpose Searches for PDF documents indexed from the domain.
site:example.com intitle:security
Purpose Finds indexed pages with 'security' in the title.
site:example.com "privacy policy"
Purpose Finds pages containing the exact phrase.
site:example.com security -jobs
Purpose Security pages while excluding anything with 'jobs'.
Important points
- Search engine indexing: Finds what Google indexed; it does not scan the target directly.
- No exploitation: Operators alone do not exploit flaws or bypass authentication.
- Sensitive information: Do not access, download or share exposed credentials or confidential files.
- False positives: Verify results before drawing any security conclusion.
- Responsible disclosure: Report accidental exposure through the organization's security contact.
Common use cases
Discover publicly indexed information about an organization.
Locate publicly indexed documents for authorized audits.
Find unintended public information on your own sites.
Support reconnaissance during authorized engagements.
Help find and remove unintended information exposure.
This tool is taught in Module 02
Read the full written notes, with diagrams, defense and detection.