Wait, Are We Hacking Google?
Disclaimer: Don’t misuse the information here. Only test servers you own, and do so at your own risk.
Don’t worry, this isn’t about hacking Google itself. The Google Hacking Database (GHDB) is a collection of “Google dorks” created by the security community. A Google dork is a specific search query made with Google’s advanced search operators. These queries help find information that Google has indexed but probably shouldn’t be public, such as exposed email lists, login credentials, sensitive files, signs of website vulnerabilities, and even financial data like payment card details.
When used correctly, the GHDB is a valuable tool for defense. Run it on your own domain to find exposures and vulnerabilities before an attacker does.
Google Dorks
A dork is a search string made with Google’s advanced search operators, designed to find something specific. In practice, people often use several dorks together. One might find a vulnerable server, another could extract user credentials, and a third might reveal exposed database credentials.
Advanced Search Operators
The table below lists Google’s main advanced search operators. These are the building blocks for every dork.
| Operator | What it does |
|---|---|
site:abc.com | Limits results to pages on abc.com |
filetype:pdf | Limits results to PDF files |
inurl:xxxxx | Result URLs must contain xxxxx |
allinurl:abc def ghi | Result URLs must contain all of abc, def, and ghi |
intitle:abc | Result titles must contain abc |
allintitle:abc def ghi | Result titles must contain all of abc, def, and ghi |
intext:abc | Result text must contain abc |
allintext:abc def ghi | Result text must contain all of abc, def, and ghi |
related:abc.com | Finds sites related to abc.com |
cache: | Shows Google’s cached version of a page |
inanchor:abc | Link anchor text must contain abc |
allinanchor:abc def ghi | Link anchor text must contain all of abc, def, and ghi |
define:abc | Shows a definition of abc |
id: | Undocumented alias for info: |
info:url | Shows information about a url |
link:url | Shows pages that link to a given url |
A few quick examples of these operators in action:
polymorphism site:stackoverflow.comsearches for “polymorphism,” but only shows results fromstackoverflow.com.cars intext:hybrid site:autoblog.comsearches for “cars,” but only onautoblog.compages that also have “hybrid” in the text.intitle:"index of"finds pages with “index of” in the title. This is a classic way to find open directory listings. Many people use this query to look for movies, games, and TV shows left exposed on misconfigured servers.
You can also prefix any term with - to exclude it from the results:
polymorphism -site:stackoverflow.comsearches for “polymorphism,” but leaves out results fromstackoverflow.com.transport -vans -carssearches for “transport,” but removes any result that mentions “vans” or “cars.”
All of this is allowed. These are just Google’s own advanced search operators, and many people use them every day to search more precisely. Try them yourself and see what you can do.
A dork uses the same operators, but with a different goal. Instead of just searching more precisely, it is meant to find sensitive information that was indexed by accident.
"#mysql dump" filetype:sqlfinds.sqlfiles that contain the exact phrase “#mysql dump.” The quotation marks tell Google to match the string exactly, instead of changing it, dropping symbols, or reordering words for a “better” result.intitle:"index of" htpasswdsearches for exposed.htpasswdfiles, which store login credentials for Apache HTTP servers. When you use this with the “index of” trick above, it can reveal servers that are leaking those credentials directly.
The most widely used Google Hacking Database on the web is maintained by Exploit-DB.
