Google

OVERVIEW

Google's advanced operators — site:, filetype:, intitle:, inurl:, and combinations of them — turn its index into a recon tool: site:target.com filetype:pdf surfaces indexed documents, intitle:"index of" finds open directory listings, and inurl:login lists discoverable admin or auth portals. None of this touches the target directly; it only reads what Google has already crawled and cached.

"Google dorking" predates most dedicated OSINT tooling and is still often the fastest way to find an exposed file, a forgotten subdomain in a cached result, or a login page that was never meant to be public — before spending time on anything more specialized.

USE CASES

Practical use cases

• 01

  Finding indexed documents (PDF, XLS, DOC) that may contain sensitive internal information.

• 02

  Locating open directory listings or misconfigured file shares exposed to the web.

• 03

  Discovering login portals, admin panels, or VPN gateways discoverable but not documented in scope.

• 04

  Pulling cached versions of pages that have since been taken down or changed.

QUICK START

Early, low-effort OSINT on any engagement, to surface publicly indexed files, portals, and exposures before running any tooling at all.

1. Start with site:target.com to see the breadth of what's indexed for the domain.
2. Layer in filetype: and intitle: operators to hunt for documents or open listings.
3. Try inurl: for common admin/login paths that might not be documented as in scope.
4. Confirm ownership and current scope of anything found before investigating it further.

BEFORE YOU RUN IT

What to check before running it