Google Dorks
Google Dorking, also known as Google Hacking, is a technique that utilizes advanced search operators to uncover specific information on the internet. While it can be used for legitimate purposes such as cybersecurity research, ethical hacking, and open-source intelligence (OSINT) gathering, it can also expose sensitive or unintendedly public data.
Database Management Interfaces
These queries help locate exposed database management interfaces and SQL dump files that may contain sensitive database structures and data.
Finds exposed phpMyAdmin login pages inurl:/phpmyadmin/index.php
Finds SQL dump files created by phpMyAdmin intext:"phpMyAdmin MySQL-Dump" filetype:sql
Finds exposed WebSQL interfaces inurl:/db/websql/
Finds exposed phpPgAdmin login pages inurl:/phpPgAdmin/index.php
Finds phpPgAdmin login pages intext:"phpPgAdmin — Login"
Exposed Credentials and Sensitive Information
Google Dorking can be used to find exposed credentials and sensitive information that may have been inadvertently published online.
Finds text files containing the word "password" filetype:txt intext:"password"
Finds log files containing the word "password" filetype:log intext:"password"
Finds configuration files containing the word "password" filetype:conf intext:"password"
Finds environment files containing the phrase "DB_PASSWORD" filetype:env intext:"DB_PASSWORD"
Finds pages containing the phrase "api_key=" intext:"api_key="
Finds pages containing the word "token" intext:"token="
Open Directories and Backups
These queries help locate open directories that may contain backup files, databases, or administrative interfaces.
Finds open backup directories intitle:"Index of /backup"
Finds open database directories intitle:"Index of /db"
Finds open admin directories intitle:"Index of /admin"
Finds open directory listings intitle:"index of /"
Vulnerable Login Pages and Admin Panels
These queries help identify login pages and admin panels that may be vulnerable to unauthorized access.
Finds URLs containing admin paths inurl:admin
Finds pages with admin login in title intitle:"admin login"
Finds URLs containing login paths inurl:login
Finds pages with login in title intitle:"login"
Username and Personal Information
Google Dorking can be used to find personal information such as usernames and email addresses.
Finds pages containing the word "username" intext:"username"
Finds pages containing the phrase "user profile" intext:"user profile"
Finds pages containing Gmail addresses intext:"@gmail.com"
Finds pages containing Yahoo addresses intext:"@yahoo.com"