Google dorking is the art of using advanced search operators to uncover pages, files, and data that standard searches simply won’t surface. This 2026 cheat sheet covers every operator still working today, tested query syntax, high-value operator combinations, 50+ real-world examples, and the defensive strategies to keep your own systems off the radar. Chain operators like site:example.com filetype:pdf intext:”confidential” or intitle:”index of” inurl:backup to uncover exposed directories, forgotten admin panels, leaked credentials, subdomains, open cameras, and other digital footprints essential groundwork for OSINT investigations, bug bounty recon, and technical SEO audits. The technique itself is completely legal; the only rule is scope: only query systems you own or are explicitly authorized to test.
What Is a Google Dork?
A Google dork, also written as googledorking (one word), dorking search, or Google hacking, is a single search query built from one or more advanced operators. The term also refers to the exposed resource itself: a file or page that should not be public but is indexed anyway. Both meanings show up in practice, so context matters.
| Term | Meaning |
|---|---|
| Dork / Google dork | One operator-based query string, or the exposed resource it finds |
| Google dorking / googledorking | The overall technique of using dorks |
| Dork Google / Dorking Google / Dorks Google | Informal verb-phrase variants for the same activity |
| GHDB | Google Hacking Database, the largest public archive of vetted dorks |
Google dorking is not “hacking” in the exploitation sense; it queries only what Google has already legally crawled and indexed. It becomes a legal issue at the point of unauthorized access, not at the point of the search itself.
Don’t confuse this with “Google cheat codes” or “cheats for Google”; those refer to Google’s Easter eggs (e.g., “do a barrel roll,” Google Gravity). They’re novelty tricks, unrelated to search operators or this guide.
Google Dorking Syntax & Fundamentals
Most people treat Google as a keyword box. Dorking treats it as a query language where operators filter the index by URL, title, body text, file type, and domain, rather than ranking by relevance.
Google dorking syntax follows three rules that break queries when ignored:
| Rule | Correct | Incorrect |
|---|---|---|
| No space after the colon | site:example.com | site: example.com |
| Operators combine with AND by default | site:example.com filetype:pdf (matches both) | Assuming it means “either” |
| OR must be uppercase | admin OR login | admin or login (read as a normal word) |
Keep these fundamentals in mind before you scale up:
- Operators are additive filters. Each one you add narrows the result set.
- Quotes force exact matches. Everything else is fuzzy.
- Google truncates long result sets. You rarely see past a few hundred results regardless of the reported count.
That’s why precise queries beat broad ones. A tight dork returns 12 relevant results; a loose one returns 40,000 you can’t page through.
Step-by-Step Google Dorking Tutorial
How to use Google dorking from zero, in order; this is the same pattern behind every dork in this guide:
- Open Google Search (desktop or mobile; syntax is identical on both).
- Pick one operator to scope your target: site:example.com.
- Narrow by format: site:example.com filetype:pdf.
- Narrow by content: site:example.com filetype:pdf intext:”confidential”.
- Exclude noise: site:example.com filetype:pdf intext:”confidential” -inurl:sample.
- Review results — only click through on assets you’re authorized to access.
- Change one variable per pass until results are clean.
- Log the query and finding for reporting if this is a bug bounty, audit, or research task.
Scope the domain → filter the type → match the content → clean with exclusions. That progression is the core of every Google dorking tutorial and applies whether you’re dorking Google from a laptop or a phone.
Complete 2026 Operators List
Operators drift over time. Some Google services have been quietly deprecated, some still work but return degraded results, and a handful remain reliable. This is the current 2026 status for every operator worth using.
| Operator | Description | Example | Notes / Status (2026) |
|---|---|---|---|
| site: | Restricts results to one domain or TLD | site:gov.uk | Working. Core operator, most reliable. |
| filetype: | Filters by file extension | filetype:pdf | Working. Primary google dork filetype operator. |
| ext: | Alias for filetype: | ext:sql | Working. Identical behavior to filetype:. |
| inurl: | Matches a string in the URL | inurl:admin | Working. Basis of inurl:dork patterns. |
| allinurl: | Requires all terms in the URL | allinurl:admin login | Working but inconsistent. Prefer chained inurl:. |
| intitle: | Matches a string in the page title | intitle:”index of” | Working. Key for directory listings. |
| allintitle: | Requires all terms in the title | allintitle:login admin | Working but degraded. Combine intitle: instead. |
| intext: | Matches a string in body text | intext:”password” | Working. Slower, broader matches. |
| allintext: | Requires all terms in body text | allintext:username password | Working but noisy. |
| “” | Exact phrase match | “internal use only” | Working. Essential for precision. |
| – | Excludes a term or operator | -site:facebook.com | Working. Removes noise. |
| OR / | | Matches either term | admin OR login | Working. Must be uppercase. |
| AND | Forces both terms (default behavior) | admin AND config | Redundant. Space already means AND. |
| * | Wildcard for unknown words | “login * portal” | Working. Matches one or more words. |
| () | Groups logic | (admin OR root) site:example.com | Working. Controls operator precedence. |
| before: | Results before a date | before:2024-01-01 | Working. Replaced older date-range tools. |
| after: | Results after a date | after:2025-06-01 | Working. Pairs with before:. |
| cache: | Google’s cached page copy | cache:example.com | Deprecated. Removed in 2024. Use the Wayback Machine. |
| related: | Sites similar to a domain | related:github.com | Degraded. Rarely useful in 2026. |
| link: | Pages linking to a URL | link:example.com | Deprecated. Non-functional for years. |
| info: | Info about a URL | info:example.com | Deprecated. Removed. |
| daterange: | Julian-date range filter | daterange:2451234-2451334 | Deprecated. Use before:/after:. |
| numrange: | Numeric range match | numrange:1000-2000 | Degraded. Use .. instead. |
| .. | Number range | camera $50..$200 | Working. Replaces numrange:. |
| @ | Search within a platform | @twitter security | Partially working. Social-focused. |
| # | Hashtag search | #osint | Partially working. |
| AROUND(n) | Proximity between two terms | admin AROUND(3) password | AROUND(n) is not a real/working Google operator — don’t use it. |
| loc: / location: | Geographic filter (News) | location:london | Limited. Google News only. |
Verdict: build every serious dork from the eight operators that never let you down — site:, filetype:, ext:, inurl:, intitle:, intext:, “”, and -. Everything else is a modifier.
Common Google Dorking Mistakes
| Mistake | Why It Fails | Fix |
|---|---|---|
| Space after colon | site: example.com cancels the operator | Remove the space |
| Lowercase or | Treated as a stop word, not Boolean logic | Use uppercase OR |
| Mixing allintitle:/allinurl: with other operators | These absorb every term that follows | Keep them isolated in the query |
| Expecting cache: to show a live snapshot | Operator removed in 2024 | Use the Wayback Machine instead |
| Relying on AROUND(n) | Not a verified/working operator | Use intext: + proximity via quoted phrases instead |
| Over-stacking 6+ operators | Google silently drops or ignores excess terms | Keep to 3–5 operators per query |
| Forgetting quotes on multi-word values | intitle:index of matches loosely | Use intitle:”index of” |
| Assuming * matches any string precisely | Wildcard fuzzy-matching has weakened over time | Prefer exact phrases where possible |
| Confusing typos (google dorkd, goole dork, google droks, googl dorks) with a different technique | These are just misspellings of “Google dork” | Same operators apply regardless of spelling |
Advanced Combinations & Techniques
A single operator rarely finds anything sensitive. Real results come from stacking three or four into one query. The pattern is always the same: scope the domain, filter the type, then match the content.
Combination logic in practice:
- Scope + type + keyword: site:example.com filetype:pdf intext:confidential
- Title + URL pattern: intitle:”index of” inurl:backup
- Exclusion to cut noise: intitle:login -inurl:blog -inurl:news
- Grouped alternatives: site:example.com (filetype:xls OR filetype:xlsx OR filetype:csv)
- Wildcard for unknown structure: inurl:”admin/*/login”
Three techniques separate a basic Google dorking tutorial from a working methodology:
- Iterative narrowing. Start broad, read the first page, then add one exclusion or keyword per pass until the results are clean.
- TLD pivoting. Swap site:example.com for site:*.example.com to catch subdomains the main query misses.
- Extension sweeping. Run the same query across sql, env, log, bak, and config extensions to map exposure surface.
That is why experienced operators keep a template and change one variable at a time. Random operator stacking wastes queries and triggers CAPTCHAs faster.
Category-Specific Dorks
Different targets need different operator patterns. These are the categories that appear on every Google dorks list 2025 and 2026, with the syntax that actually returns results. Use them only against assets you own or are authorized to test.
➥ Sensitive Files & Documents
Public file shares leak more than any single misconfiguration. Documents get uploaded, forgotten, and indexed. The Google dork filetype operator finds them fast.
site:example.com filetype:pdf intext:”confidential”
site:example.com filetype:xlsx intext:”salary”
site:example.com filetype:docx intext:”internal use only”
filetype:pdf “budget” site:gov
site:example.com (filetype:doc OR filetype:docx OR filetype:pdf)
➥ Directory Listings
Open directory listings expose entire folder trees. The signature is the auto-generated “Index of” title that servers produce when there is no landing page.
intitle:”index of” inurl:backup
intitle:”index of” “parent directory”
intitle:”index of /” “*.sql”
intitle:”index of” inurl:ftp
intitle:”index of” “config”
➥ Admin Panels & Logins
Admin panels should never be indexed. When they are, the URL and title usually give them away. This is the classic inurl: dork category.
inurl:admin intitle:login
inurl:administrator/index.php
intitle:”admin panel” -inurl:blog
inurl:/wp-admin/ intitle:”log in”
inurl:login site:example.com
➥ Configuration & Credentials
Never dork for credentials outside an authorized engagement. Within scope, config files expose secrets that belong in a vault. Environment and config files are the highest-value, highest-risk targets.
filetype:env intext:”DB_PASSWORD”
filetype:sql intext:”INSERT INTO users”
filetype:log intext:”password”
site:example.com filetype:config intext:”connectionString”
intitle:”index of” “.env”
➥ Subdomains & Recon
Subdomain discovery maps attack surface before anything else. Google indexes subdomains that DNS brute-forcing sometimes misses. Pair the wildcard with exclusions to strip the main site.
site:*.example.com -www
site:*.example.com inurl:dev
site:*.example.com inurl:staging
site:*.example.com intitle:login
site:*.example.com filetype:pdf
➥ Cameras & Devices
Exposed devices appear because default web interfaces are indexed. The titles and URL paths are predictable across vendors. Viewing a device you do not own is unauthorized access treat this section as awareness only.
intitle:”webcamXP 5″
inurl:”/view.shtml”
intitle:”Live View / – AXIS”
inurl:”ViewerFrame?Mode=”
intitle:”index of” inurl:”admin/config”
➥ Bug Bounty / Vulnerability Hunting
Bug bounty recon leans on dorking to find forgotten endpoints inside scope. The goal is exposed test environments, debug pages, and parameterized URLs. Every query below assumes you are inside a program’s defined scope.
site:example.com inurl:php?id=
site:example.com intitle:”phpinfo()”
site:example.com inurl:debug
site:example.com ext:action OR ext:jsp
site:example.com inurl:”redirect=”
➥ OSINT & People Search
Dorking is one of the fastest google dorks for OSINT free workflows. It correlates names, usernames, emails, and profiles across sites without a paid tool. The point is to aggregate public data, not to intrude.
Here is how to google dork a person using only public signals:
“John Doe” site:linkedin.com
“John Doe” “john.doe@” filetype:pdf
“John Doe” (site:twitter.com OR site:instagram.com)
intext:”John Doe” intext:”resume” filetype:pdf
“username” site:github.com
To google dork a person on a phone, run the same queries in a mobile browser. Add a number in quotes when you have one:
“+1 555 0100” OR “555-0100”
“John Doe” “555-0100”
➥ SEO & Competitor Analysis
Dorking is not only for security. Marketers use the same operators to audit indexation and scout competitors. These queries expose thin content, duplicate pages, and guest-post footprints.
site:example.com -inurl:https
site:example.com intitle:”write for us”
site:example.com inurl:blog “guest post”
site:competitor.com filetype:pdf
site:example.com intext:”powered by wordpress”
Practical Examples & Google Dorks Commands
A cheat sheet fails when the examples are vague. These are 50+ concrete Google dorks examples grouped by intent. Copy, swap the domain, and run them only against authorized targets.
➥ Files and documents
site:target.com filetype:pdf
site:target.com filetype:xls OR filetype:xlsx
site:target.com filetype:csv intext:”email”
site:target.com filetype:pptx
filetype:pdf “internal only” site:target.com
filetype:txt inurl:robots.txt site:target.com
filetype:xml inurl:sitemap site:target.com
filetype:doc “not for distribution”
➥ Directory listings
intitle:”index of” site:target.com
intitle:”index of” “backup” site:target.com
intitle:”index of” “.git” site:target.com
intitle:”index of” “uploads”
intitle:”index of” “wp-content”
intitle:”index of” “database”
➥ Admin and login endpoints
inurl:admin site:target.com
inurl:login site:target.com
intitle:”login” inurl:admin site:target.com
inurl:cpanel site:target.com
inurl:/phpmyadmin/ site:target.com
inurl:wp-login.php site:target.com
inurl:signin site:target.com
➥ Configuration and exposed data
filetype:env site:target.com
filetype:sql site:target.com
filetype:log site:target.com
filetype:ini site:target.com
filetype:bak site:target.com
inurl:config filetype:php site:target.com
intitle:”index of” “.env” site:target.com
➥ Subdomain and recon
site:*.target.com
site:*.target.com -www
site:*.target.com inurl:api
site:*.target.com inurl:test
site:*.target.com intitle:dashboard
➥ Parameters and endpoints
site:target.com inurl:”id=”
site:target.com inurl:”page=”
site:target.com inurl:”file=”
site:target.com inurl:”cmd=”
site:target.com inurl:”redirect=”
➥ OSINT and people search
“Full Name” site:linkedin.com
“Full Name” filetype:pdf resume
“Full Name” site:github.com
“username” site:reddit.com
“email@domain.com” -site:domain.com
intext:”Full Name” intext:”phone”
“Full Name” (site:facebook.com OR site:twitter.com)
➥ SEO and competitor audit
site:competitor.com
site:competitor.com inurl:blog
site:competitor.com intitle:”free tool”
site:competitor.com filetype:pdf
“keyword” intitle:”write for us”
“keyword” inurl:resources.html
➥ Technology fingerprinting
site:target.com intext:”powered by”
site:target.com inurl:wp-content
site:target.com intext:”Server at” intitle:”index of”
site:target.com inurl:.jsp
site:target.com inurl:.aspx
Common types still resolve to the same techniques, so searches for dork google, dorks google, goole dork, google droks, googl dorks, or google dorkd all point back to this same operator set. The syntax does not change because the spelling does.
Google Dorking vs. Shodan, Censys & Other OSINT Tools
Google dorking only surfaces indexed web pages. For non-HTTP exposed devices and services, dedicated scanners cover what Google can’t see — the tools are complementary, not redundant.
| Tool | Indexes | Best For | Access |
|---|---|---|---|
| Google Dorking | Public web pages Google crawled | Files, admin panels, directories, leaked docs | Free |
| Shodan | Internet-connected device banners | Cameras, IoT, exposed ports/services | Freemium |
| Censys | Internet-wide host/certificate scans | Infrastructure mapping, cert intel | Freemium |
| Bing Dorking | Bing’s index (similar operators: site:, filetype:, ip:) | Cross-check/secondary source | Free |
| GHDB | Curated dork database | Ready-made query categories | Free |
Use Google dorking for content-layer exposure and Shodan/Censys for infrastructure-layer exposure — e.g., cameras and devices not served over standard web paths.
Defensive Google Dorking & Protection
Finding exposure is half the job. The other half is closing it before someone else runs the same query against you. Defensive dorking means you dork your own assets on a schedule and fix what surfaces.
Run these controls to reduce your indexed footprint:
- robots.txt disallow rules. Block crawlers from admin paths, backups, and staging. Note that robots.txt is a request, not enforcement — attackers read it as a map.
- X-Robots-Tag and meta noindex. Use HTTP headers or <meta name=”robots” content=”noindex”> for pages that must never rank. This actually removes them from the index, unlike robots.txt.
- Authentication on everything non-public. Never rely on an unlisted URL. Obscurity is not access control.
- Remove indexed secrets fast. Use Google Search Console’s Removals tool, then rotate any leaked credential immediately.
- Block sensitive extensions at the server. Deny direct access to .env, .sql, .bak, .log, and .config regardless of location.
A defensive robots.txt starting point:
User-agent: *
Disallow: /admin/
Disallow: /backup/
Disallow: /config/
Disallow: /staging/
Disallow: /*.sql$
Disallow: /*.env$
Verdict: robots.txt alone protects nothing. Pair it with noindex, authentication, and monthly self-dorking to actually reduce exposure.
Limitations, Legality, Ethics & Best Practices
Dorking looks harmless because it only touches Google’s index. That assumption gets people in legal trouble. The search is legal; what you do with the results decides everything.
Know the hard limits of the technique:
- Rate limiting and CAPTCHAs. Aggressive automated queries get your IP throttled or blocked within minutes.
- Index freshness. Results lag reality. A fixed page may still appear in the index for weeks.
- Truncated results. Google hides most matches past the first few hundred, so counts are unreliable.
- No access guarantee. Finding a login panel is not finding a way in.
The legal and ethical line is not subtle:
- Searching is legal. Running any query in this guide does not break any law.
- Accessing exposed private data is not. Opening a file or panel you are not authorized to view can violate computer-misuse laws in most jurisdictions.
- Authorization is mandatory for testing. Only dork assets you own or have written permission to assess.
- Report, do not exploit. If you find someone else’s exposed data, report it through a responsible disclosure channel.
Best practices that keep your work clean:
- Stay inside defined scope on every engagement.
- Log your queries so your activity is auditable.
- Never store or share credentials you encounter.
- Treat every discovered secret as something to report, not use.
Quick Reference / Printable Cheat Sheet
This is the compressed version. Keep it beside you while you work.
Core operators (2026 working)
| Operator | Purpose | Example |
|---|---|---|
| site: | Limit to domain | site:example.com |
| filetype: / ext: | Filter by extension | filetype:pdf |
| inurl: | Match URL string | inurl:admin |
| intitle: | Match title string | intitle:”index of” |
| intext: | Match body text | intext:”password” |
| “” | Exact phrase | “internal use only” |
| – | Exclude term | -inurl:blog |
| OR | Either term | admin OR login |
| * | Wildcard word | “login * portal” |
| before: / after: | Date filter | after:2025-01-01 |
Deprecated — do not use
| Operator | Status | Replacement |
|---|---|---|
| cache: | Removed 2024 | Wayback Machine |
| link: | Non-functional | Backlink tools |
| info: | Removed | site: |
| daterange: | Removed | before:/after: |
| numrange: | Degraded | .. |
Fast task lookup
| Goal | Dork pattern |
|---|---|
| Find documents | site:target.com filetype:pdf |
| Find directories | intitle:”index of” site:target.com |
| Find admin panels | inurl:admin intitle:login site:target.com |
| Find config leaks | filetype:env site:target.com |
| Find subdomains | site:*.target.com -www |
| Dork a person | “Full Name” site:linkedin.com |
| SEO audit | site:target.com inurl:blog |
Syntax rules
- No space after the colon.
- OR must be uppercase.
- Space between operators means AND.
- Quotes force exact matches.
Resources & Tools
Manual dorking is slow at scale. These resources automate the repetitive parts and keep your dork library current.
- Google Hacking Database (GHDB): The reference archive of vetted dorks, maintained by Exploit-DB. Start every research session here.
- DorkSearch: A dork search interface that builds and runs queries from a template library, useful when you want speed over memorization.
- Pagodo / Dorky: Open-source automation for running GHDB dorks against a target list programmatically.
- Wayback Machine: The working replacement for the deprecated cache: operator.
- Google Search Console: Your own removal and indexation control panel for defensive work.
Use these to scale a workflow, not to run untargeted mass scans. The tools only change speed. Scope, authorization, and ethics are still on you.
Cheat Sheet Version History (2020–2026)
Older resources like a Google search cheat sheet 2020 PDF or a Google dorking cheat sheet 2021 listicle still reference operators that no longer behave the same way.
| Version Era | What Changed |
|---|---|
| 2020 PDF-era sheets | Relied on daterange: (Julian dates), heavy link: usage |
| 2021 cheat sheets | Treated cache: as fully reliable |
| 2026 (this guide) | before:/after: replace date filtering; cache: removed; AROUND(n) confirmed non-functional; link:/info:/related: unreliable |
Always check a downloaded PDF cheat sheet’s publish date before relying on it — operator deprecation is the most common reason old dork lists silently stop working.
Frequently Asked Questions (FAQs)
What is Google dorking?
Google dorking uses advanced search operators to find pages, files, and exposed data that normal searches miss. You chain operators like site:, filetype:, and inurl: to filter Google’s index down to exactly what you need.
How do I use Google dorking?
Start with one operator to scope your target — site:example.com — then stack additional operators to narrow by file type, URL pattern, or page content. Add exclusions with – to cut noise. Change one variable per pass until results are clean.
Is Google dorking legal?
Running the queries is legal. Accessing, downloading, or misusing data you are not authorized to view is not. Computer misuse laws in most jurisdictions treat unauthorized access as a criminal act, regardless of how easy the data was to find.
Which operators still work in 2026?
The eight reliable operators are site:, filetype:, ext:, inurl:, intitle:, intext:, “”, and -. “OR, *, before:, after:, and () also work. cache:, link:, info:, and daterange: are deprecated and non-functional. AROUND(n) is not a verified operator.
How do I Google dork a person using only public information?
Use their full name in quotes combined with platform-specific site: filters, for example, “Jane Doe” site:linkedin.com or “Jane Doe” filetype:pdf resume. Stick to publicly indexed data and never access private records.
Can I use Google dorking on a phone?
Yes. Open any mobile browser, go to google.com, and type your dork query exactly as you would on desktop. The operators work identically. Smaller screens make long queries harder to type, so keep your dorks short.
What does filetype: or ext: do?
Both operators filter results by file extension. filetype:pdf returns only PDF files. ext:sql returns only SQL files. They behave identically — use whichever you prefer.
Does cache: still work in 2026?
No. Google removed the cache: operator in 2024. Use the Wayback Machine at web.archive.org to retrieve historical snapshots of any indexed page.
How do I protect my site from Google dorking?
Run these four controls together: add Disallow rules in robots.txt for sensitive paths, apply noindex headers or meta tags on pages that must never rank, require authentication on every non-public resource, and use Google Search Console’s Removals tool to pull any accidentally indexed secrets fast.
What is a Google dork in OSINT?
In OSINT workflows, a Google dork is a targeted query that maps a target’s public digital footprint, including subdomains, exposed documents, employee profiles, and misconfigured endpoints, without directly touching any system. Tools like DorkSearch and Pagodo automate this process against a defined target list.
