0Pricing
Cyber Security Academy · Lesson

Google Dorking for Information Gathering

Use advanced Google search operators to find sensitive information exposed on the web.

Google Dorking for Information Gathering is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Google Dorking?

Google Dorking (Google Hacking) uses advanced search operators to find sensitive information indexed by Google. Security professionals use it for recon; attackers use it to find exposed data, login pages, and vulnerable servers.

Core Search Operators

Essential Google operators:

site:example.com              # all pages on a domain
filetype:pdf site:example.com  # PDFs on a domain
intitle:"index of" site:gov    # directory listings on .gov
inurl:admin                    # URLs containing "admin"
cache:example.com              # Google's cached version

Finding Exposed Files

Common dorking patterns for exposed sensitive data:

filetype:env site:github.com   # .env files on GitHub
filetype:sql "password"        # SQL dumps with passwords
filetype:log "error" site:*    # log files
filetype:xlsx "password" site:example.com

Finding Login Panels

Discovering admin interfaces:

inurl:"/wp-admin" site:example.com
intitle:"phpMyAdmin" inurl:"/phpmyadmin"
inurl:"/admin/login"
intitle:"Cisco ASDM" inurl:"admin"

The Google Hacking Database (GHDB)

The GHDB at Exploit-DB contains thousands of curated dorks organized by category: sensitive directories, error messages, files containing passwords, vulnerable servers, and web server detection. Essential reference for security researchers.

Finding Vulnerable Applications

Finding specific vulnerable software versions:

intitle:"Apache Tomcat" "Apache Tomcat/8.0"
intitle:"Welcome to nginx!" inurl:"/"
intext:"Powered by WordPress 4.7"

Site-Specific Email Harvesting

Finding email addresses exposed on a domain:

site:example.com intext:"@example.com"
site:linkedin.com "example.com" "email"
# Also try: hunter.io, theHarvester tool

Subdomain Discovery via Dorking

Finding subdomains and infrastructure:

site:*.example.com
site:example.com -www
# Reveals: dev.example.com, api.example.com, staging.example.com

Document Metadata Exposure

PDF, Word, and Excel files often contain author names, internal hostnames, software versions, and email addresses in metadata. Dorking for documents reveals this organizational intelligence without touching any system.

Legal and Ethical Considerations

Google dorking is legal — you're querying publicly indexed data. However:

  • Accessing exposed data you found may be unauthorized
  • Using dorking against systems you don't own during a pentest requires authorization
  • Report exposures responsibly to affected organizations

Automating Dork Searches

Tools that automate Google dorking:

  • theHarvester — email/subdomain harvesting
  • FOCA — document metadata extraction
  • dorks.py — automated dork scanning (use carefully, Google blocks automation)
theHarvester -d example.com -l 200 -b google

Quick Check: Google Dorking

Which Google operator restricts search results to a specific domain?

Lesson Recap

Google dorking uses advanced search operators to find sensitive information indexed publicly. Key operators: site:, filetype:, intitle:, inurl:. The GHDB provides curated dorks for security research. While querying is legal, accessing exposed data or using it against unauthorized targets is not. Always get written authorization for professional engagements.

Frequently asked questions

Is the “Google Dorking for Information Gathering” lesson free?

Yes — the full text of “Google Dorking for Information Gathering” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Google Dorking for Information Gathering”?

Use advanced Google search operators to find sensitive information exposed on the web. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Google Dorking for Information Gathering” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Google Dorking for Information Gathering
  2. WHOIS, DNS Enumeration, and Certificates
  3. Shodan: The Search Engine for Internet Devices
  4. Social Media and People-Search OSINT
← Back to Cyber Security Academy