ZeroTrace OSINT
Google Dorks Builder
Build advanced search queries with operator chips, shorthand syntax, and a curated category catalog.
A "Google dork" is an advanced search query that uses Google's operators (site:, filetype:, intitle:, inurl:, etc.) to find specific content the search engine has indexed. The builder makes constructing these queries fast — operator chips, shorthand syntax, and a category catalog of common reconnaissance dorks.
What you build
| Operator | What it does |
|---|---|
site:example.com | Restrict to a domain |
filetype:pdf | Restrict to a file extension |
ext:pdf | Synonym for filetype: |
intitle:"login" | Phrase in the page title |
inurl:"admin" | Phrase in the URL |
intext:"password" | Phrase in the page body |
cache:url | Show Google's cached version |
link:url | Pages linking to URL (deprecated; included for completeness) |
-keyword | Exclude pages containing keyword |
"phrase" | Exact-phrase match |
Shorthand syntax
For fast typing, the builder accepts a shorthand:
| Type | Expands to |
|---|---|
s:example.com | site:example.com |
f:pdf | filetype:pdf |
t:login | intitle:login |
u:admin | inurl:admin |
x:php | ext:php |
-keyword | exclude |
"..." | exact phrase |
s:example.com f:pdf "internal use only" becomes site:example.com filetype:pdf "internal use only" in one keystroke.
Curated dork catalog
The builder ships with categories of common reconnaissance dorks:
| Category | Examples |
|---|---|
| Exposed configurations | filetype:env "DB_PASSWORD", inurl:".git/config", inurl:"wp-config.php.bak" |
| Exposed credentials | intext:"password" filetype:log, intext:"BEGIN RSA PRIVATE KEY" |
| Login portals | inurl:"admin/login.php", intitle:"Sign in" inurl:"phpMyAdmin" |
| Document leaks | site:example.com filetype:doc OR filetype:xls "confidential" |
| Open directories | intitle:"index of" "parent directory" |
| Subdomains visible to search | site:*.example.com -site:www.example.com |
Each catalog entry has a one-click "use this dork" affordance that pre-fills the builder.
Result rendering
The builder constructs the query and offers:
- Open in Google — opens the constructed query in your browser.
- Open in DuckDuckGo / Bing / Yandex — same query against alternative engines.
- Copy as text — for pasting into a report.
Dorking surfaces content that has been indexed — meaning it was once publicly accessible. Even if the original page has been removed, a Google cache, Wayback snapshot, or third-party mirror may still hold it. Treat dork findings as time-sensitive — capture them quickly before they disappear.
Save as profile
Frequent dork patterns save as named profiles. A "quarterly competitor leak sweep" can be one click.
Pivots
Dork results (the URLs you find when you run the query in your browser) pivot into:
- Site analysis.
- Wayback archive — for archive coverage.
- URL parser / analyzer.
Sources
- The dork catalog is bundled.
- The actual searches happen in your browser when you click through — Google / DuckDuckGo / Bing / Yandex own those queries.