My Favorite Google Dorks

Search for a command to run...

Interesting read! I remember doing something similar with Minecraft Realms invite links to find realms(which are private).
In this series, I will be talking about common OSINT tools and concepts like Google Dorking, Sherlock, Maltego, etc.
Sherlock is a powerful command line tool that can be used to find usernames across many websites and social networks. It works on Linux, MacOS and Windows. Installation To install Sherlock, follow the instructions below. Make sure that you have Pytho...
During in the process of reverse engineering binaries, a common problem arises. How do I reverse engineer stripped binaries? There are no symbols to break on, offsets change, scripts don't work, and you ask yourself why am I doing this? Luckily there...

When I was learning how to tackle pwn challenges in CTFs, I had a tough time finding a single, clear guide that could show me the ropes of actually carrying out these exploits. That's why I decided to put together a complete guide that covers everyth...

Using python to capture and project data

Intro This is a write-up for PicoCTF 2022: Buffer Overflow 1. This is one of my favourite challenges to do. I recommend solving it for yourself before you read this write-up. What is a Buffer Overflow? Before we get started we need to first know what...

What is a BadUSB? A BadUSB is a USB device that acts as a keyboard and injects preprogrammed keystrokes into a computer. A BadUSB is Indistinguishable from a generic keyboard, making it near impossible to detect and patch. You can setup reverse shell...

Google Dorking is when you use Google search queries to gain access to hidden information on websites. Some of this information google was not meant to index. This can be things such as log files, passwords, ssh-keys, etc. Google Dorking is a useful skill everyone should know.
Before we get into Google Dorking we need first to understand how Google works. This article talks about how search engines work, but here is a quick run down.
Google sends out bots to a bunch of different websites. It indexes everything on the website it is allowed. Using specific search queries on Google you can get that hidden information.
Google Dorking is not illegal along as you don't log in to pages. As soon as you try to log in to a protected page then it becomes illegal and you can get into serious trouble. Always check your local laws.
Furthermore, I would always recommend a VPN when Dorking just as an extra set of protection. You don't need it but it is always good to use. Also, be careful about what you click on, as the stuff you see may not be family-friendly.
This is a very simple example of what a Google Dork would be:
site:hashnode.com filetype:pdf
Google will search https://hashnode.com for all PDF files hosted under that domain name. And as you see below it comes up with a bunch of interesting results

I am just going to dump a bunch of useful syntaxes you can go refer to. If you want to see a larger list go here.
| Term | Action |
| "" | The specified term must be an exact match |
| OR | Operator OR |
| AND | Operator AND |
| - | Excludes a term |
| * | Wildcard, it can be anything |
| site: | The specified site must be the host |
| filetype: | Search for a file by its extension (e.g. PDF) |
| cache: | View Google's Cached version of a specified URL |
| intitle: | The specified phrase MUST appear in the title of the page |
| inurl: | Pages with a certain phrase in the url |
| ip: | The specified IP must be the host |
| after: | after certain period |
These are some fun advanced searches.
There are lots of different queries for passwords but here is a couple:
password filetype:doc | filetype:docx | filetype:pdf | filetype:xls site:Your site
"admin_password" ext:txt | ext:log | ext:cfg
filetype:log intext:password after:2016 intext:@gmail.com | @yahoo.com | @hotmail.com
There are many dorks to find webcams around the world. Here are a few:
inurl:"view.shtml" "Network Camera"
"Camera Live Image" inurl:"guestimage.html"
alt_text
intitle:”webcamXP 5”
An example of what you can get is:

Now, this is my favourite one. Why bother doing recon when you can get someone elses work:
intitle: "report" ("qualys" | "nessus" | |acunetix" | "netsparker" | "nmap") filetype:pdf
An example of what you can get is:

Bellow is a collection of dorks. Try them out yourselves. If you want even more their is a ton on exploit-db
Sources:
https://tryhackme.com/room/googledorking
https://www.boxpiper.com/posts/google-dork-list
https://moz.com/beginners-guide-to-seo/how-search-engines-operate
https://null-byte.wonderhowto.com/how-to/find-passwords-exposed-log-files-with-google-dorks-0198557/