Google Dorks Reference | How I Stole Your Data

NOTES

Google dorking is structured search, not a vulnerability by itself. I use it during authorized reconnaissance to understand what a search engine has indexed for an in-scope organization: public documents, forgotten hostnames, login surfaces, old paths, exposed directory listings, and technology clues.

Every query starts with a domain I own or am explicitly allowed to assess. Search results can be stale, incomplete, or misleading, so I treat them as leads to validate inside scope—not proof of impact.

CORE OPERATORS

Limit the scope

site:example.com

Restricts results to the authorized domain. Use a leading minus to omit a noisy host or term.

site:example.com -www
site:example.com -"privacy policy"

Match a phrase or alternatives

site:example.com "exact phrase"
site:example.com (docs OR support)

Quotes keep a phrase together. Uppercase OR is useful when two terms describe the same lead.

Look at titles, URLs, and document types

site:example.com intitle:portal
site:example.com inurl:docs
site:example.com filetype:pdf

intitle: searches page titles, inurl: searches indexed URLs, and filetype: narrows results to a document format.

Bound results by date

site:example.com after:2025-01-01
site:example.com before:2026-01-01 after:2025-01-01

Date filters can reduce noise when looking for a recent migration, release, or documentation change. Indexed and published dates do not always mean the same thing.

QUERY RECIPES

Public documents

site:example.com (filetype:pdf OR filetype:docx OR filetype:xlsx)
site:example.com (filetype:pptx OR filetype:csv)

Authentication and administration surfaces

site:example.com (inurl:login OR inurl:signin OR inurl:portal)
site:example.com (intitle:admin OR intitle:dashboard)

Subdomains and non-default hosts

site:*.example.com -www
site:example.com -site:www.example.com

Directory listings and indexed configuration formats

site:example.com intitle:"index of"
site:example.com (filetype:xml OR filetype:json OR filetype:yml)

Finding a result does not authorize retrieving sensitive material. Capture the smallest evidence needed, avoid opening exposed secrets, and report the indexing problem through the agreed channel.

WORKFLOW

Write the approved root domain and exclusions at the top of the notes.
Start with a plain site: query and record unusual hosts, paths, titles, and file types.
Add one operator at a time so it is clear which constraint changed the result set.
Use safe placeholders in reusable notes; keep client names and sensitive results in the assessment workspace.
Validate an interesting result against the live, authorized asset before treating it as current.
Record the query, result URL, observation date, and why the result matters.

GOTCHAS

Operators and result behavior change; a query returning nothing does not prove the content is absent.
Search snippets and cached metadata can outlive the page that produced them.
Do not automate Google result scraping or attempt to bypass rate limits and anti-abuse controls.
The Google Hacking Database is a catalog of patterns, not a scope list. Rewrite every example around an authorized domain.
Separate discovery from exploitation. Search-engine evidence is usually enough to raise a validation task.

Google Dorks / Search Operators