How to Use Google Dorks?

To use a Google Dork, you simply type in a Dork into the search box on Google and press “Enter”. Here are some of the best Google Dork queries that you can use to search for information on Google.

Google Dork Queries Examples:

• site:.edu “phone number”– This Dork searches for websites on .edu domains that contain the words “phone number”. student “phone number” – This Dork searches for websites on .edu domains that contain the words “student” and “phone number”.
• inurl:edu “login” – This Dork searches for websites on .edu domains that contain the words “login”. This Dork searches for school websites that contain student login information.
• “powered by vbulletin” site:.edu – This Dork searches for websites on .edu domains that contain the words “powered by vbulletin”. This Dork searches for school websites that are running on the vbulletin forum software.
• “powered by vbulletin” site:.gov – This Dork searches for websites on .gov domains that contain the words “powered by vbulletin”. This Dork searches for governmental websites that are running on the vbulletin forum software.
• “powered by vbulletin” site:.mil – This Dork searches for websites on .mil domains that contain the words “powered by vbulletin”. This Dork searches for military websites that are running on the vbulletin forum software.
• “powered by vbulletin” inurl:.edu – This Dork searches for websites on .edu domains that contain the words “powered by vbulletin”. This Dork searches for school websites that are running on the vbulletin forum software.
• “powered by vbulletin” inurl:.mil – This Dork searches for websites on .mil domains that contain the words “powered by vbulletin”. This Dork searches for military websites that are running on the vbulletin forum software.
• inurl:.com “powered by vbulletin” – This Dork searches for websites on .com domains that contain the words “powered by vbulletin”. This Dork searches for websites that are running on the vbulletin forum software.
• inurl:.edu “register forum” – This Dork searches for websites on .edu domains that contain the words “register forum”. This Dork searches for school websites that allow you to register for a forum.
• inurl:.gov “register forum” – This Dork searches for websites on .gov domains that contain the words “register forum”. This Dork searches for governmental websites that allow you to register for a forum.

Scraper API provides a proxy service designed for web scraping. With over 20 million residential IPs across 12 countries, as well as software that can handle JavaScript rendering and solving CAPTCHAs, you can quickly complete large scraping jobs without ever having to worry about being blocked by any servers.

Google Dorks Updated Database for Error Messages:

intext:"Error Occurred While Processing Request"
intitle:"index of" "stacktrace.log"
intitle:"index of" "my-errors.log" OR "my-errors.logs"
intitle:"index of" errors.log
inurl:"index.php?id=" intext:"Warning: mysql_num_rows()"
inurl:"/WebResource.axd?d=" AND intext:Error
inurl:("/storage/logs/laravel.log") AND intext:("local.ERROR" | "NULL.ERROR" | "EMERGENCY:")
intext:"TCPDFtcpdf.php on line 17778" -stackoverflow -wordpress -github
intext:"sf_app" + "frontend sf_app_base_cache_dir:"
inurl:elmah.axd ext:axd
intitle:"Error log for /LM/"
inurl:"/errors/report.php" intext:"There has been an error processing your request"
site:*/wp-admin/maint/repair.php intext:"define(WP_ALLOW_REPAIR,true);"
site:*/wp-includes/Requests/php_errorlog
site:*/cgi-sys/defaultwebpage.cgi intext:"SORRY!"
site:*/cgi-sys/suspendedpage.cgi intitle:"Account Suspended"
site:*/Shibboleth.sso/SAML2/POST
site:*/404/404.html intitle:"404"
filetype:php "Notice: Undefined variable: data in" -forum
site:com inurl:jboss filetype:log -github.com
inurl:/php-errors.log filetype:log
"dispatch=debugger."
"syd_apply.cfm"
inurl:?wp-commentsrss2.php -git
"CakeRoutingException" -site:github.com -site:stackoverflow.com -site:cakephp.org"
inurl:".php?id=" "You have an error in your SQL syntax"
intitle:"CGIWrap Error"
"--- WebView Livescope Http Server Error ---" -git
"Below is a rendering of the page up to the first error." ext:xml
inurl:index of driver.php?id=
intext:"expects parameter 1 to be resource, boolean given" filetype:php
intitle:"Struts Problem Report" intext:"development mode is enabled."
inurl:"id=" & intext:"MySQL Error: 1064" & "Session halted."
intitle:"DSM Terminator [ ABORT ]" | inurl:"./com.sap.portal.dsm.Terminator"
inurl:/siteminderagent/ | app:"Error 404: java.io.FileNotFoundException: SRVE0190E: File not found: /siteminderagent/"
inurl:/smpwservices.fcc | "/lm_private/CkeSetter.aspx"
inurl:/console-selfservice/common/scripts/calendar/ipopeng.htm
inurl:/nesp/app
inurl:/SAML2/SOAP/ | inurl:/SAML2/POST
inurl:/uniquesig0/ or inurl:/uniquesig0/InternalSite/
inurl:index.php?id= intext:"mysql_fetch_array"
intitle:Content Server Error IdcService=DOC_INFO
intitle:"Whoops! There was an error."
intitle:Error-javax.el.ELException+error+xhtml
intitle:Error Page pageWrapper.jsp?
intext:"Unexpected Problem Occurred!" ext:aspx
intext:"Access denied for" intitle:"Shopping cart"
"[function.getimagesize]: failed to open stream: No such file or directory in"
inurl:advsearch.php?module= & intext:sql syntax
intext:"Fatal error: Class 'Red_Action' not found in"
"CHARACTER_SETS" "COLLATION_CHARACTER_SET_APPLICABILITY"
inurl:"*.php?*=*.php" intext:"Warning: include" -inurl:.html -site:"php.net" -site:"stackoverflow.com" -inurl:"*forums*"
inurl:"index.php?m=content+c=rss+catid=10"
"plugins/wp-db-backup/wp-db-backup.php"
allintext:"fs-admin.php"
intitle:"Apache Tomcat" "Error Report"
"Warning: Bad arguments to (join|implode) () in" "on line" -help -forum
"Unable to jump to row" "on MySQL result index" "on line"
"Warning:" "failed to open stream: HTTP request failed" "on line"
"Warning: Division by zero in" "on line" -forum
"Warning: mysql_connect(): Access denied for user: '*@*" "on line" -help -forum
filetype:asp + "[ODBC SQL"
"Warning: Supplied argument is not a valid File-Handle resource in"
"Warning:" "SAFE MODE Restriction in effect." "The script whose uid is" "is not allowed to access owned by uid 0 in" "on line"
"There seems to have been a problem with the" " Please try again by clicking the Refresh button in your web browser."
intitle:"Default PLESK Page"
"Parse error: parse error, unexpected T_VARIABLE" "on line" filetype:php
"[SQL Server Driver][SQL Server]Line 1: Incorrect syntax near" -forum -thread -showthread
intitle:"404 SC_NOT_FOUND"
intext:"Error Message : Error loading required libraries."
"Warning: mysql_query()" "invalid query"
intitle:Configuration.File inurl:softcart.exe
"The script whose uid is " "is not allowed to access"
databasetype. Code : 80004005. Error Description :
"Warning: pg_connect(): Unable to connect to PostgreSQL server: FATAL"
filetype:log "PHP Parse error" | "PHP Warning" | "PHP Error"
"error found handling the request" cocoon filetype:xml
"ASP.NET_SessionId" "data source="
"ORA-12541: TNS:no listener" intitle:"error occurred"
"Internal Server Error" "server at"
filetype:php inurl:"logging.php" "Discuz" error
PHP application warnings failing "include_path"
intext:"Warning: Failed opening" "on line" "include_path"
intitle:"Error Occurred While Processing Request"
intitle:"htsearch error" ht://Dig error
intitle:"Error using Hypernews" "Server Software"
"Invision Power Board Database Error"
intitle:"Execution of this script not permitted"
intitle:"Error Occurred" "The error occurred in" filetype:cfm
filetype:asp "Custom Error Message" Category Source
"Fatal error: Call to undefined function" -reply -the -next
warning "error on line" php sablotron
intitle:"the page cannot be found" inetmgr
intitle:"the page cannot be found" "2004 microsoft corporation"
inurl:sitebuildercontent
inurl:sitebuilderfiles
inurl:sitebuilderpictures
intitle:"the page cannot be found" "internet information services"
intitle:"500 Internal Server Error" "server at"
"mySQL error with query"
"An illegal character has been found in the statement" -"previous message"
"A syntax error has occurred" filetype:ihtml
"detected an internal error [IBM][CLI Driver][DB2/6000]"
An unexpected token "END-OF-STATEMENT" was found
"Unclosed quotation mark before the character string"
"access denied for user" "using password"
"Warning: Cannot modify header information - headers already sent"
"Can't connect to local" intitle:warning
intitle:"Under construction" "does not currently have"
"Syntax error in query expression " -the
"Supplied argument is not a valid PostgreSQL result"
"You have an error in your SQL syntax near"
"Supplied argument is not a valid MySQL result resource"
"ORA-00936: missing expression"
"ORA-00921: unexpected end of SQL command"
"ORA-00933: SQL command not properly ended"
"Incorrect syntax near"
"Incorrect syntax near" -the
"PostgreSQL query failed: ERROR: parser: parse error"
"ORA-00921: unexpected end of SQL command"

A Google Dork is a search query that looks for specific information on Google’s search engine. Google Dorks are developed and published by hackers and are often used in “Google Hacking”.

Google Dorks are extremely powerful. They allow you to search for a wide variety of information on the internet and can be used to find information that you didn’t even know existed.

Because of the power of Google Dorks, they are often used by hackers to find information about their victims or to find information that can be used to exploit vulnerabilities in websites and web applications.

Google Search Engine is designed to crawl anything over the internet and this helps us to find images, text, videos, news and plethora of information sources. With it’s tremendous capability to crawl, it indexes data along the way, which also includes sensitive information like email addresses, login credentials, sensitive files, website vulnerabilities, and even financial information. In many cases, We as a user won’t be even aware of it.

Search Operators :

• cache:

  • [cache:www.google.com web] will show the cached content with the word “web” highlighted. This functionality is also accessible by clicking on the “Cached” link on Google’s main results page. The query [cache:] will show the version of the web page that Google has in its cache. For instance, [cache:www.google.com] will show Google’s cache of the Google homepage.

• link:

  • [link:www.google.com] will list webpages that have links pointing to the Google homepage.

• related:

  • [related:www.google.com] will list web pages that are similar to the Google homepage.

• info:

  • [info:www.google.com] will show information about the Google homepage.

• define:

  • The query [define:] will provide a definition of the words you enter after it, gathered from various online sources. The definition will be for the entire phrase entered (i.e., it will include all the words in the exact order you typed them). Eg: [define:google]

• stocks:

  • If you begin a query with the [stocks:] operator, Google will treat the rest of the query terms as stock ticker symbols, and will link to a page showing stock information for those symbols. For instance, [stocks: intc yhoo] will show information about Intel and Yahoo. (Note you must type the ticker symbols, not the company name.)

• site:

  • If you include [site:] in your query, Google will restrict the results to those websites in the given domain. For instance, [help site:www.google.com] will find pages about help within www.google.com. [help site:com] will find pages about help within .com urls. Note there can be no space between the “site:” and the domain.

• allintitle:

  • If you start a query with [allintitle:], Google will restrict the results to those with all of the query words in the title. For instance, [allintitle: google search] will return only documents that have both “google” and “search” in the title.

• intitle:

  • If you include [intitle:] in your query, Google will restrict the results to documents containing that word in the title. For instance, [intitle:google search] will return documents that mention the word “google” in their title, and mention the word “search” anywhere in the document (title or no). Putting [intitle:] in front of every word in your query is equivalent to putting [allintitle:] at the front of your query: [intitle:google intitle:search] is the same as [allintitle: google search].

• allinurl:

  • If you start a query with [allinurl:], Google will restrict the results to those with all of the query words in the url. For instance, [allinurl: google search] will return only documents that have both “google” and “search” in the url. Note that [allinurl:] works on words, not url components. In particular, it ignores punctuation. Thus, [allinurl: foo/bar] will restrict the results to page with the words “foo” and “bar” in the url, but won’t require that they be separated by a slash within that url, that they be adjacent, or that they be in that particular word order. There is currently no way to enforce these constraints.

• inurl:

  • If you include [inurl:] in your query, Google will restrict the results to documents containing that word in the url. For instance, [inurl:google search] will return documents that mention the word “google” in their url, and mention the word “search” anywhere in the document (url or no). Putting “inurl:” in front of every word in your query is equivalent to putting “allinurl:” at the front of your query: [inurl:google inurl:search] is the same as [allinurl: google search].

Google search service is never intended to gain unauthorised access of data but nothing can be done if we ourselves kept data in the open and do not follow proper security mechanisms.

Essentially emails, username, passwords, financial data and etc. shouldn’t be available in public until and unless it’s meant to be. Example, our details with the bank are never expected to be available in a google search. But our social media details are available in public because we ourselves allowed it.

Ending Note

Google Search is very useful as well as equally harmful at the same time. Because it indexes everything available over the web.

You need to follow proper security mechanisms and prevent systems to expose sensitive data. Follow OWASP, it provides standard awareness document for developers and web application security.

Scraper API provides a proxy service designed for web scraping. With over 20 million residential IPs across 12 countries, as well as software that can handle JavaScript rendering and solving CAPTCHAs, you can quickly complete large scraping jobs without ever having to worry about being blocked by any servers.

Note: By no means Box Piper supports hacking. This article is written to provide relevant information only. Always adhering to Data Privacy and Security.