Search operators
Google, Bing, and DuckDuckGo dorks — operators, syntax, and compound dorks
site:site:linkedin.com "John Smith" "Redstone Arsenal"Restrict results to specific domain. Combine with quotes for precision.
"exact phrase""operational security" "Huntsville" filetype:pdfForce exact phrase match. Enclose in double quotes.
filetype:site:army.mil filetype:pdf "TSCM" 2023Filter by file extension: pdf, docx, xlsx, pptx, csv, sql, log, txt, conf
inurl:inurl:admin inurl:login site:govURL must contain string. Useful for finding login pages, admin panels, exposed directories.
intitle:intitle:"index of" "parent directory" "passwords"Page title must contain string. Classic for open directory indexing.
intext:intext:"api_key" site:github.comPage body must contain string. Complements intitle.
cache:cache:targetsite.com/pageShow Google's cached copy. Useful when target has removed content.
related:related:palantir.comShow sites Google considers related/similar. Maps competitive landscape.
link:link:targetsite.comFind pages linking to URL. (Deprecated in Google — use for Bing)
OR / |"John Smith" (FBI OR "Federal Bureau") site:linkedin.comBoolean OR — either term must appear. Must be uppercase.
- (exclude)"John Smith" Alabama -baseballExclude pages containing term. Reduces false positives.
* (wildcard)"worked at * from 2018"Wildcard within quoted phrase. Fills in unknown words.
before:/after:site:twitter.com "John Smith" before:2020-01-01Date range filtering. Useful for historical OSINT.
numrange:SSN numrange:555-00-0000-555-99-9999Search for numbers in range. Rarely needed but occasionally useful for document hunting.
Open dir dorkintitle:"index of" "parent directory" site:targetdomain.comClassic open directory listing. Finds exposed file servers. Add filename terms to narrow.
Login page dorkinurl:login OR inurl:signin OR inurl:admin site:targetdomain.comFind authentication endpoints. Pair with exposed credential searches.
Config file dorkfiletype:env OR filetype:conf "DB_PASSWORD" site:github.comExposed configuration files. Commonly contain credentials, API keys, database strings.
Camera dorkintitle:"webcamXP" OR inurl:"/view/view.shtml" OR intitle:"Live View / - AXIS"Exposed IP cameras. Cross-reference with Shodan for confirmation.
Document metadata dorkfiletype:pdf site:target.gov "prepared by"Documents often contain author names, email addresses, internal paths in metadata.