| Guide | GDE-016 |
| Topic | Google dorking |
| Domain | Digital infrastructure |
| Last updated | August 2026 |
Short answer: Start with site:targetdomain.com, add operators such as filetype:, intitle: and inurl: to query the search engine index directly, then run proven GHDB queries and repeat key searches on a second search engine.
What is Google dorking?
Google dorking is the use of advanced search operators to surface indexed content that standard keyword search misses, including exposed documents, login portals, misconfigured directories and specific file types on a target's domain. It answers what a search engine has indexed about a target that the target never intended to be publicly discoverable.
Search engines index far more than a website's homepage. Operators such as site:, filetype: and intitle: let an investigator query that index directly, surfacing PDFs, spreadsheets, configuration files and login pages that a general search would bury or never return at all. Because dorking works entirely through a search engine's public interface, it requires no special access and leaves no trace on the target's own systems.
Investigators use dorking to find exposed documents before a target notices and removes them, identify subdomains and infrastructure not linked from a target's main site, and locate specific file types such as spreadsheets or internal presentations that frequently contain sensitive detail.
| • | Locating exposed documents, spreadsheets or presentations on a target domain |
| • | Finding subdomains and infrastructure not linked from the main website |
| • | Identifying login portals and administrative interfaces exposed to the open web |
| • | Searching for a target's content republished or cached elsewhere after removal |
| • | Investigating a company's digital footprint before a deeper technical assessment |
How do you use Google dorking for OSINT?
Combine search operators to narrow the index to exactly the content type and scope you need.
Free before paid. Dorking itself requires nothing beyond a search engine; the tools below help scale and organise the technique.
Google Advanced Search: Free. The core tool; supports site:, filetype:, intitle:, inurl:, and intext: operators alongside date-range and language filters. No account required for basic use.
Google Hacking Database (GHDB): Free. Maintained by Exploit-DB, a curated library of proven dork queries organised by category (exposed files, login portals, vulnerable servers), useful as a starting point rather than building every query from scratch.
Pagodo: Free and open source. Automates running a batch of GHDB-style dorks against a target domain and logs the results, useful when checking a large number of query patterns systematically.
Bing Advanced Search: Free. Bing's index differs from Google's and occasionally surfaces content Google has not indexed or has since removed; running the same dorks against both engines catches more.