Skip to content
Home

Google dorking cheat sheet

Search operators for surfacing exposed files, directories, and forgotten dev portals via Google.

text·1 min read··INE Certification

Google dorking is passive OSINT by definition: you only ever query Google, never the target directly. That makes it a zero-risk first step for surfacing things a site owner probably didn’t mean to expose.

Operators

site:example.com                  limit results to a specific domain
site:*.example.com                show subdomains for that domain
inurl:admin                       results with a specific word in the URL
intitle:index of                  finds sites with directory listing enabled (a common misconfig)
filetype:pdf site:example.com     limit results to a file type on a specific domain
cache:example.com                 show Google's cached version of a page

Combined examples

inurl:auth_user_file.txt
inurl:passwd.txt
inurl:wp-config.bak

intitle:index of is the single highest-signal dork here. It surfaces web servers with directory listing left enabled, which routinely exposes files nobody intended to publish. The Google Hacking Database is a very useful, much larger collection of pre-made dorks and is worth bookmarking.