Smarter Web Surfing with Google Dorks

Google "hacking" is something that just about every cyber security news site has done an aritcle on, and while it can be pretty useful when searching a website for vulnerablities, the most practical use for it is finding resources and information online without the clutter that comes with most websites. Before we go any further into this, I want to make it clear that typing some things into a google search bar is not "hacking". In fact, Google Dorking is 100% legal. If it's open to the web, then it's fair game. The only time that web surfing becomes illegal is when you sign into an account you do not own.

Getting Started with Dorking

Google "Dorking" is when you use Google's built-in search operators (aka dorks) to target specific content in your searches. To follow along with this tutorial/guide, you might want to first look over a list of the basic dorks, which you can find here. For simplicity's sake, I'm going to just list out a few dork examples that I've used previously when browsing the web.

• intext:"steam" intext:"username" intext:"password" filetype:txt‐ Usually you can find a couple of free account dumps using this, but if you're using Google dorks to find account lists, you're not gonna find high level Steam accounts with hundreds of games on them. Chances are, you'll find some level 0 VAC banned accounts, but if you're looking for thousands of steam accounts for some reason, this is your answer. Of course, you can always just replace steam with pretty much any other high profile platform, or you can straight up drop that part to see which idiots are storing passwords in plain text. If you also don't feel like typing out all those intext dorks, you can just use allintext, but I find this to be far less reliable than seperating it.
• intitle:"index of" hacking‐ I personally find that it's much easier to dig through peoples' indexes of their files rather than browse the cluttered site to find the information. For extra bonus points, you can drop the "hack" part of the search to just dig through random shit that people have on their servers. For example, moments ago I found an instruction manual for a DCD-1 Data Cartridge Drive as well as pictures that the owner took of it.
• intext:"@gmail.com" filetype:txt‐ If you're looking to do some phishing or just looking for some emails to try to brute force, this can be a good way to build up a long list of emails, especially if you use a little bit of automation.