Generate advanced Google search operators (Dorks) for passive OSINT reconnaissance on a target domain. No direct requests to the target — results are sourced entirely from Google's public index.
Enter a domain to enable Search. Until then the queries show a TARGET_DOMAIN placeholder you can copy.
Sensitive Files
.env files
Environment config leaks
site:TARGET_DOMAIN filetype:env
.log files
Server & app log files
site:TARGET_DOMAIN filetype:log
.conf files
Configuration files
site:TARGET_DOMAIN filetype:conf
.sql dumps
Database dump files
site:TARGET_DOMAIN filetype:sql
.backup files
Backup archives
site:TARGET_DOMAIN filetype:backup OR filetype:bak
.key / .pem
Private keys & certs
site:TARGET_DOMAIN filetype:key OR filetype:pem
Public Documents
PDF files
PDFs with potential metadata
site:TARGET_DOMAIN filetype:pdf
Word docs
Microsoft Word documents
site:TARGET_DOMAIN filetype:doc OR filetype:docx
Excel sheets
Spreadsheets with data
site:TARGET_DOMAIN filetype:xls OR filetype:xlsx
Presentations
PowerPoint / slide decks
site:TARGET_DOMAIN filetype:ppt OR filetype:pptx
Text files
Plain text & readme files
site:TARGET_DOMAIN filetype:txt OR filetype:md
XML / JSON data
Data export / API response files
site:TARGET_DOMAIN filetype:xml OR filetype:json
Open Directories
Index of /
Open directory listings
site:TARGET_DOMAIN intitle:"index of"
Index of /backup
Open backup directories
site:TARGET_DOMAIN intitle:"index of" backup
Index of /uploads
Open upload directories
site:TARGET_DOMAIN intitle:"index of" uploads
Index of /admin
Open admin directories
site:TARGET_DOMAIN intitle:"index of" admin
Apache listing
Apache server directory listing
site:TARGET_DOMAIN intitle:"index of" "apache"
FTP indexes
FTP-style directory listings
site:TARGET_DOMAIN intitle:"index of" "ftp"
Login & Admin Panels
Admin panels
Generic admin panel URLs
site:TARGET_DOMAIN inurl:admin
Login pages
Login form pages
site:TARGET_DOMAIN inurl:login
WordPress admin
WP admin login page
site:TARGET_DOMAIN inurl:wp-admin
Dashboard
Dashboard & control panels
site:TARGET_DOMAIN inurl:dashboard
cPanel / WHM
Hosting control panel URLs
site:TARGET_DOMAIN inurl:cpanel OR inurl:whm
phpMyAdmin
DB management interfaces
site:TARGET_DOMAIN inurl:phpmyadmin
Server Errors
PHP errors
PHP parse & fatal errors
site:TARGET_DOMAIN "PHP Parse error" OR "PHP Fatal error"
SQL errors
SQL syntax error strings
site:TARGET_DOMAIN "You have an error in your SQL syntax" OR "mysql_fetch_array()" OR "Warning: mysql_"
500 errors
Internal server error pages
site:TARGET_DOMAIN "Internal Server Error"
Django debug
Django debug mode pages
site:TARGET_DOMAIN "You're seeing this error because you have DEBUG = True"
Stack traces
Exception stack trace leaks
site:TARGET_DOMAIN "Exception" "stack trace"
database errors
DB connection error strings
site:TARGET_DOMAIN "database error" OR "DB Error"
Subdomains & Recon
All subdomains
All indexed subdomains
site:*.TARGET_DOMAIN -site:www.TARGET_DOMAIN
Dev / staging
Development & staging envs
site:TARGET_DOMAIN inurl:dev OR inurl:staging OR inurl:test
API endpoints
Public API endpoint paths
site:TARGET_DOMAIN inurl:api
Pastebin mentions
Domain referenced on Pastebin
site:pastebin.com "TARGET_DOMAIN"
GitHub mentions
Domain referenced on GitHub
site:github.com "TARGET_DOMAIN"
Exposed ports
Non-standard ports in URLs (few are indexed)
site:TARGET_DOMAIN inurl:8080 OR inurl:8443 OR inurl:3000
Passive OSINT only. This tool generates Google search URLs — no requests are made directly to the target. Results depend entirely on what Google has indexed. Always ensure you have authorization before using reconnaissance data offensively.
What is the Google Advanced Search Operators (Dorking)?
Type in a target domain and this tool builds ready-to-use Google search-operator queries — site:, filetype:, intitle:, inurl: — grouped into categories like exposed files, open directories, and login panels, so you don't have to memorize the syntax.
How it works
Each preset combines one or more Google operators into a query string for the domain you entered, then opens it as a normal Google search in a new tab (or copies the raw query to your clipboard). Nothing is ever sent to the target domain itself — every result comes from what Google has already indexed publicly.
SysAdmin & security use cases
»Finding accidentally exposed .env or .sql files on a target domain.
»Discovering open directory listings that reveal server structure.
»Locating admin panels and login pages within a security audit's scope.
»Identifying verbose error pages that leak stack traces or database details.
»Mapping indexed subdomains and forgotten dev or staging environments.