Google Dorking 101.

A search engine indexes what is public on the internet. Dorking means narrowing a search with operators so that only certain results appear, for example one website or one file type.

It does not break into anything. It only finds what is already indexed and reachable. That is exactly the problem: a file that was put online by mistake can be found by anyone who asks the right question.

It is one technique within open-source intelligence. The OSINT Framework even marks entries that rely on it with a D.

A dork is simply a carefully built query. For a defender, the value is speed: in a few minutes you can see roughly what a stranger sees when searching for your company, without special software and without touching your systems.

These operators are described in Google’s own Search help. Aimed at your own domain, each one shows a different kind of exposure.

Operators can be combined. Practitioners also use others, such as intitle: and inurl:, but treat those as less certain, because Google can change how operators behave.

Run searches against your own domains and write down what you find. Combine site: with your domain and one other operator at a time.

• Search your domain for document types such as PDF, spreadsheets and presentations, and read the titles.
• Search your domain for words you would never want public, such as “internal use only” or “confidential” in quotes.
• Look at the list of indexed pages for subdomains you had forgotten.
• Repeat on a schedule, since new content is indexed all the time.

Only search your own organization. Searching other people’s systems for weaknesses can cause legal trouble even when the results are public.

Dorking pays off when it is routine. A short monthly check is enough for most teams.

Prepare

List every domain and subdomain you own, and keep a short list of words that mark sensitive material in your company, such as internal project names or labels like “confidential”.

Search

For each domain, run site: on its own and then with filetype: for the document types you publish. Add your marker words in quotes. Use after: to look only at what is new since the last check.

Record and fix

Note each result, who owns it and the fix. Close the loop by running the same search a week later to confirm the result is gone.

Finding an exposed file is only the start. Fixing it means removing the file, not just hiding the result.

• Take the file offline or put it behind a login. Rotate any password or key that appeared in it.
• Ask Google to remove the old result, using its removal tools in Search Console, once the page is gone.
• Use a robots.txt file only to guide crawlers. It is not a security control, and the file itself is public.
• Do not publish internal files in public folders. Check what a content system or file upload exposes by default.
• Remove metadata such as author names and paths from documents before publishing.

A clean result does not mean you are safe. Dorking only shows pages the search engine has indexed and chosen to show, and results change over time.

• It cannot see pages behind a login, or services that are open but not indexed.
• It misses leaks on other sites, such as code hosting, paste sites and criminal forums.
• It gives no warning when something new appears between two checks.

Treat it as a quick, cheap health check, and use it to learn what an outsider can see in a few minutes.

Search engines are only one place where data leaks. The same file or key can show up in a code repository, a paste site, a cloud storage bucket or a criminal forum. Dorking will not see most of these.

That is why dorking works best inside a wider routine. Attack surface management tracks the internet-facing assets that answer for your company. See our guide to External Attack Surface Management and the glossary entry on attack surface.

Data leak monitoring covers the rest: it watches for your data in places a search engine does not reach, such as dark web markets and leaked credentials lists. Brandefense Dark Web Monitoring does this continuously, so a team does not depend on manual searches.

• Google Search help: refine web searches: the operators described in this guide.
• OSINT Framework: marks dork-based entries with a D.
• MITRE ATT&CK: the reconnaissance tactic and how attackers gather information.
• CISA: public guidance for defenders on reducing exposure.