Skip to main content

​
Overview

The Google Hacking tool uses advanced search operators (Google dorks) to discover exposed sensitive information, misconfigurations, and security issues indexed by search engines. Google Hacking is a discovery tool: it helps you find publicly indexed information but does not test for vulnerabilities. Since searches are performed directly in your browser, this tool does not add data to your Attack Surface or generate findings.
This tool uses your browser to make requests to Google. Your browser must allow popups for the search results to open.

​
How it works

Unlike other tools on the platform, Google Hacking doesn’t run a scan on our servers. Instead:
  1. Enter your target domain
  2. Click on a search category
  3. A new browser window opens with the Google search results
  4. Review the indexed content Google has found
This approach means you’re searching Google directly from your browser, giving you real-time results.

​
Parameters

​
Search categories

The tool provides pre-built search queries organized into categories:

​
Files and directories

​
Authentication pages

​
Errors and debug info

​
External sources

​
Discovery

Run these searches regularly to detect accidentally exposed files before attackers do. New exposures often happen after deployments.

​
Follow-up actions

After discovering exposed information:
  1. Check external sources: Don’t just search your own site, check paste sites and code repositories where developers might have accidentally shared credentials
  2. Use Wayback Machine: Historical snapshots can reveal previously exposed content
  3. Fingerprint technologies: Use the Website Recon tool on discovered URLs
  4. Discover hidden files: Use the URL Fuzzer to find files not indexed by Google
  5. Enumerate subdomains: Use the Subdomain Finder for active subdomain enumeration