Skip to content
HackIndex logo

HackIndex

Google Dork Reconnaissance

3 min read May 15, 2026

Google indexes publicly accessible content including admin panels, configuration files, backup archives, error pages, and directory listings. Targeted dorks surface these before any active scanning touches the target. Everything here is passive — you're querying Google's index, not the target server.

Use dork results as direct targets for content discovery and misconfiguration scanning.

Admin and Login Panels

Search for exposed authentication interfaces before bruteforcing content:

site:example.com inurl:admin
site:example.com inurl:login OR inurl:signin OR inurl:auth
site:example.com intitle:"admin panel" OR intitle:"administrator"
site:example.com inurl:wp-admin
site:example.com inurl:phpmyadmin
site:example.com inurl:manager OR inurl:console

Exposed Configuration and Backup Files

Developers sometimes push or leave sensitive files in publicly accessible directories:

site:example.com ext:env
site:example.com ext:config
site:example.com ext:bak OR ext:backup OR ext:old
site:example.com ext:sql OR ext:db
site:example.com ext:log
site:example.com ext:ini
site:example.com filetype:xml inurl:config
site:example.com "DB_PASSWORD" OR "database_password" OR "db_pass"

Directory Listings

Directory listing pages reveal file structure and often expose files not linked from the main application:

site:example.com intitle:"index of"
site:example.com intitle:"index of" "parent directory"
site:example.com intitle:"index of" ".git"
site:example.com intitle:"index of" "backup"
site:example.com intitle:"index of" ".env"

Error Pages and Stack Traces

Error pages in search results reveal technology stack, framework versions, and file paths:

site:example.com intext:"sql syntax" OR intext:"mysql error"
site:example.com intext:"Warning: include" OR intext:"Warning: require"
site:example.com intext:"Traceback (most recent call last)"
site:example.com intext:"ORA-" OR intext:"Microsoft OLE DB"
site:example.com intext:"Exception in thread" filetype:jsp
site:example.com "Internal Server Error"

Error messages containing SQL syntax errors confirm SQL injection attack surface exists somewhere in the application. File path disclosures in PHP warnings reveal the server directory structure.

Parameter-Driven Pages

Pages with dynamic parameters in the URL are injection testing candidates:

site:example.com inurl:"?id="
site:example.com inurl:"?page="
site:example.com inurl:"?file="
site:example.com inurl:"?path="
site:example.com inurl:"?include="
site:example.com inurl:"?redirect=" OR inurl:"?url=" OR inurl:"?next="

The redirect and url parameter dorks specifically surface open redirect and SSRF candidates. The file and include parameter dorks surface local file inclusion candidates. Feed these directly into file inclusion vulnerability detection.

Sensitive Document and Data Exposure

Documents indexed by Google sometimes contain internal data:

site:example.com filetype:pdf "confidential"
site:example.com filetype:xlsx OR filetype:csv
site:example.com filetype:doc OR filetype:docx intext:"password"
site:example.com intext:"BEGIN RSA PRIVATE KEY"
site:example.com intext:"api_key" OR intext:"apikey" OR intext:"api-key"

Subdomain Discovery via Google

Google often indexes subdomains not visible in DNS or CT logs, particularly short-lived or development environments:

site:*.example.com -site:www.example.com
site:example.com -www
site:*.*.example.com

The -site:www.example.com exclusion removes the main domain from results so only subdomains appear. Combine results with certificate transparency enumeration and subdomain bruteforce for full coverage.

Automating Dork Queries

For bulk dork execution, pagodo automates Google dork searches across a target domain using the GHDB:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/opsdisk/pagodo && cd pagodo && python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
Explain command
https://github.com/opsdisk/pagodo URL of the remote repository to clone.
-r requirements.txt Install dependencies listed in the specified requirements file.
--break-system-packages Allow pip to modify system-managed Python packages.
┌──(kali㉿kali)-[~]
└─$ python3 pagodo.py -d $DOMAIN -g dorks/files.txt -l 50 -s -e 35.0 -j 1.1
Explain command
-d $DOMAIN Target domain to scope the Google dork queries against.
-g dorks/files.txt Path to file containing Google dork queries to execute.
-l 50 Limit results to a maximum of 50 URLs per dork.
-s Save results to an output file.
-e 35.0 Maximum delay in seconds between requests to avoid rate limiting.
-j 1.1 Minimum delay multiplier jitter factor between requests.

References