Google dorking/hacking: What is it and how to use it?

If you're having trouble finding specific information on Google, Google dorking, also called Google hacking, is a specialized search technique that uses hidden operators and commands supported by Google to craft precise queries that return more targeted results.

In this article, you’ll learn everything you need to know about these search queries, including a complete list of supported Google dorking commands and practical examples.

Why we care

If you're scraping websites for public data, you need to know what’s actually discoverable. Google dorking gives you a preview of what content is already exposed and indexable. It helps you:

• Identify scrape targets more efficiently
• Avoid scraping sensitive or unintended data
• Map a site's structure before running automated workflows

Paired with a tool like Apify's Google Search Results Scraper, you can scale up these discoveries and turn manual dorking into a repeatable, automated process.

What is Google dorking?

Google dorking, sometimes called "Google hacking," is the use of advanced search queries to find specific information from Google's indexed resources. The idea is to rely on a special search syntax — involving commands and operators supported by Google — to narrowly refine results.

It’s commonly used by power users to find information that isn't easily discoverable through regular searches, or by SEO experts to study keyword usage. However, it can also be abused by malicious actors to uncover sensitive data or public vulnerabilities.

For example, a misconfigured web server may be letting Google index files and directories that should be private. Those resources can be retrieved with a carefully crafted Google docking search query (hence the alternative name, “Google hacking”). Such search queries are called “Google dorks.”

How to perform Google dorking searches

To perform a dorking search on Google, you don't need to be a hacker or have coding skills. Anyone can do it.

All you have to do is open Google and enter a search query using the special Google dorking syntax. For example, if you want to search for articles about “web scraping” exclusively on the Apify blog (whose URL is https://blog.apify.com), you can write this query:

site: web scraping

Notice how all search results are limited to the target site specified in the site: command, which is one of the many operators Google supports for dorking/hacking.

Google dorking commands

There's no official Google documentation listing all supported operators and commands for dorking. In fact, some operators that worked in the past are now deprecated or return inconsistent results.

The closest thing to an official reference is the “Google Advanced Search Operators” document compiled by Daniel M. Russell, a senior research scientist who worked for Google.

Here, we’ll refer to that resource, along with our own tests, to present the main currently supported Google dorking operators — omitting any operators that no longer work.

1. site:

Restricts search results to a specific website, domain, or all pages under a particular URL (e.g. site:apify.com/storewill return all pages under the apify.com/store section of the website).

Example:

site:.edu penguin research

Google will return pages about penguin research only from .edu domains (universities and research institutions).

Why it's useful: Focuses searches on a single site or specific/high-level domain, which is helpful for site-specific research or monitoring content.

2. Phrase search ("...")

Finds pages containing the exact words in the specified order.

Example:

"climate change impact report"

Google will return pages that include the exact phrase “climate change impact report,” preserving word order.

Why it's useful: Guarantees precise matches, especially useful for quotes, names, or exact phrases.

3. before: / after:

Filters results by publication date.

Note: The date must be in YYYY-MM-DD format. If you only provide the year, Google defaults to January 1st of that year.

Example:

smartphone trends before:2022-02-04

Google will return pages about smartphone trends published before February 4, 2022.

Why it's useful: Helps focus on content from a specific timeframe. That’s important for research, historical data, or tracking trends.

4. filetype:

Limits results to specific file types, like PDF, XML, PPTX, DOCX, and others.

Example:

filetype:pdf machine learning tutorial

Google will return indexed PDF documents acting as machine learning tutorials.

Why it's useful: Ideal for finding documents, slides, and reports rather than regular web pages.

5. allinanchor: / inanchor:

Searches for pages where all (allinanchor:) or a single (inanchor:) query term (or its synonyms) appear in the anchor text of links pointing to that page.

Example:

allinanchor: best coffee shop Seattle

Google will return pages linked using anchor text that contains “best,” “coffee,” and “Seattle” (or synonyms).

Why it's useful: Helps find pages strongly associated with certain keywords through backlinks, useful for SEO research or identifying popular linked content.

6. allintext: / intext:

Restricts results to pages containing all (allintext:) or a single (intext:) term (or its synonyms) in the visible text.

Example:

allintext: solar panel installation tips

Google will return pages whose main content includes all the words “solar,” “panel,” “installation,” and “tips” (or synonyms).

Why it's useful: Ensures that the content actually mentions your search terms in the body, not just in titles or URLs, which improves search accuracy.

7. allintitle: / intitle:

Limits results to pages where all (allintitle:) or a single (intitle:) query term (or its synonyms) appear in the page title.

Example:

allintitle: beginner guitar chords

Google will return pages with titles containing all the words “beginner,” “guitar,” and “chords” (or synonyms).

Why it's useful: Quickly identifies pages focused on a specific topic, since titles usually summarize the main content.

8. allinurl: / inurl:

Returns pages where all (allinurl:) or a single (inurl:) term appears in the URL.

Example:

allinurl: recipes chocolate cake

Google will return pages whose URLs contain “recipes,” “chocolate,” and “cake” (or synonyms).

Why it's useful: Helps locate specific sections, categories, or types of files within a website, particularly for document retrieval.

9. define

Returns definitions from online sources for the term or phrase following the operator.

Note: This operator was previously written as define:, but the colon should no longer be added.

Example:

define blockchain

Google will return a list of definitions for “blockchain” from reputable online sources.

Why it's useful: Quickly provides reliable definitions without visiting multiple sites, saving time for learning or research.

10. (wildcard)

Acts as a placeholder for unknown terms in a phrase.

Example:

"best * apps 2025"

Google will return pages mentioning “best” followed by any word(s) and ending with “apps 2025” ( e.g., “Best Android Apps 2025,” “Best Apple Watch Apps 2025,” etc.)

Why it's useful: Helps discover variations or fill in missing words in phrases, which is helpful for research or brainstorming.

11. (minus)

Excludes words or operators from results.

Example:

jaguar -car -football

Google will return pages mentioning “jaguar” but excluding results that include “car” or “football” (so, referring to the animal).

Why it's useful: Refines searches by removing irrelevant results, saving time and improving relevance.

12. .. (number range)

Finds pages containing numbers within a specific range.

Example:

camera $200..$500

Google will return pages that mention cameras priced between $200 and $500.

Why it's useful: Great for price ranges, years, or numeric data filtering, useful for shopping or statistical research.

13. OR

Searches for pages containing either term.

Example:

"remote work" OR telecommuting

Google will return pages that include either the “remote work” term or “telecommuting” and its synonyms.

Why it's useful: Expands search to include synonyms or alternatives, increasing coverage for research.

Important notes

These are the main notes highlighted by Daniel M. Russell in his Google dorking guide:

• Combinations of operators: Multiple operators like , OR, and quotes ("...") can be combined in a single Google dorking search query. For example, cybersecurity news -site:news.yahoo.com finds cybersecurity articles while excluding Yahoo News.
• Support for special characters: Google can search for many symbols, such as ∞, $, %, #, or emojis (e.g., 🚀, ❤️, etc.). That wasn’t the case in the past.
• Parentheses in searches: Google ignores parentheses in search queries. So, for instance, (Python tutorial) OR (Java guide) is interpreted as Python tutorial OR Java guide.
• Word order matters: The sequence of words affects search results. For example, best practices for SEO and SEO for best practices produce significantly different results.
• Proper grouping: To group terms effectively, run separate searches and combine the results manually.

For other search options, such as filter by language, publication date, usage rights, and more, use the Google Advanced Search page.

Google dorking cheat sheet: What Google sees (and how you can scrape it)

For a quick overview of this search technique, refer to the Google dorking cheat sheet table below. You can use these search operators to uncover public data for SEO, OSINT, and web scraping.

Google dorking examples

Explore some examples of Google dorking applied to real-world use cases and scenarios.

1) Site- and term- specific searches

Results returned by Google may sometimes be too broad, so you might want to restrict the search to a specific domain and certain words.

For example, use the following Google dork to find pages that contain “web scraping” in the title and the word “tutorial” on Medium:

site:medium.com intitle:"web scraping" "tutorial"

That query makes it much easier to locate relevant results on any platform!

2) File discovery

Assume you want to quickly locate publicly available PDF guides, white papers, or cheatsheets on cybersecurity best practices. Below’s how you can achieve that:

filetype:pdf cybersecurity "best practices" OR "white paper" OR "cheatsheet"

3) Monitoring specific topics across multiple subdomains

Suppose you want to track reports on climate change across all government subdomains while excluding NASA. Find them with:

site:*.gov "climate change report" -site:www.nasa.gov

See how Google returns content across multiple .gov subdomains except the excluded one. That’s useful for monitoring distributed content across an organization or sector.

4) Sitemap discovery

Not all sites have a public robots.txt file, and even if they do, it may not include a link to the sitemap. Sometimes, sitemaps are accidentally exposed and indexed by Google, allowing you to retrieve them with the right dorking query. Having access to a sitemap makes crawling a site much easier.

For example, use this query to locate XML sitemaps on educational websites:

filetype:xml sitemap site:*.edu

That finds XML sitemaps on “.edu” domains, which is useful for quickly understanding the site structure or web scraping.

5) Identifying exposed configuration files

Malicious users may search for publicly exposed configuration files or directories using a query like this:

inurl:config intitle:"index of"

This query returns directories with “config” in the URL that have an index page. As a protective measure, you can restrict such queries to your own domain for security audits. That would help you detect files and directories that may have been accidentally exposed to the public.

6) Subdomain discovery

Assume you want to identify all publicly indexed subdomains of a website. You can achieve that goal with a query like this:

site:amazon.com -site:www.amazon.com

The resulting SERPs contain all Amazon subdomains except the main “www.amazon.com” domain. That's helpful for mapping an organization’s web presence or monitoring content distribution across subdomains.

7) Generic complex searches

With complex queries involving multiple operators, you can use Google dorking for highly specific searches, such as discovering GPT-like chat services:

site:*gpt.com inurl:chat

That query finds pages with “chat” in the URL across all domains ending with “gpt.com.”

Conclusion

Now you know why Google dorking is also called Google hacking. It allows you to instruct Google to perform more precise and specialized searches using hidden operators and commands. You also saw real-world examples to demonstrate how these queries work in practice.

If you want to programmatically run these searches and retrieve results, check out Apify’s Google Search Results Scraper.

Frequently asked questions

What is Google dorking used for?

Google dorking is used by:

• Security professionals to identify misconfigured web servers.
• Power users to find specific documents, public data, or information missed by standard searches.
• SEO experts to audit website indexing, check for duplicate content, and research competitor strategies.
• Malicious actors to find exposed sensitive information, files, or configurations.

Is Google dorking legal?

Yes, Google dorking is legal because it only allows you to discover publicly available information. However, using it to access or exploit sensitive, private, or unauthorized data that was made public by mistake is unethical.

What are Google dorks?

Google dorks are search queries that use Google dorking operators and commands. Basically, any Google search combining operators and commands can be considered a Google dork.

What are the biggest limitations of Google Dorking?

Dorking queries can only discover web pages or files that are actually indexed. Now, keep in mind that many sources estimate Google indexes a very small percentage of the entire Internet, roughly between 5% and 15%. Plus, Google dorking commands change over time, and there is no official documentation detailing them.

Is Google Dorking a security threat, and how can you protect against it?

OWASP recognizes Google dorking as both a potential threat and a reconnaissance technique. Skilled testers can combine operators to uncover sensitive files or information, generally using lists of known effective dorks, such as the Google Hacking Database. To reduce risks, carefully assess the sensitivity of any information before making it available to search engines, and regularly review existing content to verify it doesn’t expose confidential data.

What is DorkGPT?

DorkGPT is an AI-powered service that automatically generates advanced Google dorking search queries. It is primarily used in SEO, cybersecurity, and ethical hacking.