Google Dorking

Advanced Google searches are a powerful technique to perform recon.

This is also called Google Dorking. Google's search engine has its own built-in query language that helps you filter your searches.

site

This tells Google to show you results from a certain site only.

print site:python.org

inurl

Searches for pages with a URL that match the search string. It's a powerful way to search for a vulnerable page on a particular website.

inurl:"/course/jumpto.php" site:example.com

intitle

Finds specific strings in page's title. This is useful because it allows you to find pages that contain a particular type of content.

intitle:"index of" site:example.com

link

Searches for web pages that contain links to a specified URL. You can use this to find documentation about obscure technologies or vulnerabilities.

link:"https://en.wikipedia.org/wiki/ReDoS"

filetype

Searches for pages with a specific file extension. Hackers often use it to locate files on their target sites that might be sensitive, such as log and password files.

filetype:log site:example.com

Wildcard (*)

You can use the wildcard operator within searches to mean any character or series of characters.

How to hack * using Google

Quotes (" ")

Adding quotation marks around your search terms forces an exact match. And this query will search for pages with terms how, to, and hack, alhough not necessarily together.

"how to hack"

Or (|)

The or operator is denoted with the pipe character and can be used to search for one or the other or both at the same time.

"how to hack" site:(reddit.com | stackoverflow.com)

Minus (-)

The minus operator excludes certain search results. Following query will search for pages that contain how to hack websites but not php:

"how to hack websites" -php