Google Dorking for Investigators: Advanced Search Operators

Search engines are designed to index everything they can access. Often, they index things administrators never intended to be public. Google Dorking (or Google Hacking) is the practice of using advanced search operators to filter this massive index down to highly specific, sensitive, or hidden information.

The Core Operators

Effective dorking relies on combining specific operators to narrow the search scope drastically.

• •site: Limits results to a specific domain or TLD (e.g., site:target.com or site:.gov).
• •filetype: Restricts results to specific file extensions (e.g., filetype:pdf, filetype:xls, filetype:sql).
• •intitle: Searches only within the title metadata of the webpage.
• •inurl: Searches only within the URL string.
• •intext: Searches for specific text in the body of the page.

Reconnaissance and Directory Exposure

When a web server is misconfigured, it may display a directory listing instead of a webpage, exposing every file in that folder to the internet.

Investigators can find these exposed directories using the operator: intitle:"index of" site:target.com. This simple query often reveals backup archives, internal documents, or development code that was temporarily placed on a public server and forgotten.

Finding Leaked Credentials and Documents

Employees frequently upload sensitive data to public-facing platforms without realizing it. Using filetype operators combined with specific keywords is highly effective.

• •Finding financial data: site:target.com filetype:xls intext:"confidential" OR intext:"budget"
• •Finding configuration files: site:target.com filetype:env OR filetype:cfg
• •Discovering passwords: inurl:"/wp-content/uploads/" filetype:txt intext:"password"

Viewing Cached and Deleted Content

If a target realizes their mistake and deletes a page, Google might still hold a copy. Using the cache: operator (e.g., cache:target.com/deleted-page) instructs Google to serve the last stored version of the site directly from its servers. This is an essential first step before turning to the Wayback Machine.

Third-Party Platform Exposure

Targets often leak data on third-party sites like Pastebin, Trello, or GitHub. Dorking against these platforms is just as important as targeting a specific domain.

For example, searching site:pastebin.com "targetcompany.com" OR "target_executive_name" can uncover leaked source code, internal email dumps, or threat actor discussions targeting the organization.