Post cover image

August 2, 2026

DorkinatorAI: a calmer way to start recon using AI

A practical introduction to building a repeatable search-query workflow for bug bounty and security testing.

By Devansh Patel

6 min read

Use this responsibly: Dorkinator is for domains you own or have explicit permission to assess. Search results are leads for manual review, not confirmed vulnerabilities.

Most people learn Google dorking the same way: a browser full of tabs, a notes file full of half-remembered queries, and a growing suspicion that they have checked the same thing twice.

Dorkinator is a small Python tool that makes that early reconnaissance work more repeatable. Give it an approved domain, and it produces a structured collection of search queries for Google or Bing. You can save those queries as text, CSV, or JSON, work through them at your own pace, and keep a clear record of what you searched.

If you want to go further, Dorkinator also has an optional local AI triage mode. It collects results from a local SearXNG instance or the Brave Search API, keeps only URLs that fall inside your approved scope, and asks a locally running Qwen model to flag pages worth a closer look. The model does not make the finding for you. It gives you a smaller pile to inspect.

That distinction matters. Reconnaissance is not a race to produce dramatic screenshots. It is a method for finding relevant information, checking it carefully, and staying inside scope.

What Dorkinator actually does

Dorkinator builds search queries across five useful areas:

  • Surface discovery: indexed pages, subdomains, backups, configuration files, documents, and common web assets.
  • Cloud exposure checks: public references across services such as GitHub, Pastebin, S3, Azure Blob Storage, Google Cloud Storage, and file-sharing platforms.
  • API discovery: API paths, OpenAPI or Swagger material, GraphQL references, and likely credential-related strings.
  • Potential exposure review: public key markers, cloud credential patterns, Slack token patterns, and sensitive-looking documents.
  • Endpoint discovery: admin areas, development environments, repositories, search parameters, redirect parameters, error pages, and upload paths.

The tool does not crawl a target, bypass authentication, submit forms, or scrape Google and Bing result pages. Its normal mode simply creates links to searches you can open yourself. That makes it a useful companion for a scoped engagement, a bug bounty recon checklist, or a beginner learning how search engines reveal an application's public footprint.

Installation

You need Python 3.9 or later. Clone the repository, make the installer executable, then run it.

git clone https://github.com/Zuri09/Dorkinator.git
cd Dorkinator
chmod +x install.sh
./install.sh

The installer creates a project-local .venv and adds the optional terminal-colour dependency there. It does not modify Homebrew's managed Python installation. You can then generate a query collection for a domain you are authorised to test:

.venv/bin/python dorkinator.py example.com

Dorkinator writes the result to dorkinator-output/example.com_dorks.txt.

None

Your first run

Try the tool against example.com, a reserved documentation domain. It is a good way to see the workflow without pointing searches at a real target.

.venv/bin/python dorkinator.py example.com --engine bing --format json

That command does three things:

  1. It swaps Google for Bing.
  2. It generates Dorkinator's full query collection.
  3. It writes a JSON export that is easy to feed into a spreadsheet, notes system, or a small script.

The output has the domain, category, query, and clickable search URL for every entry. For a quick manual review, the default text format is usually enough. Use CSV when you want to track work in a spreadsheet. Use JSON when you want to automate the next step.

# Text for a manual review session
.venv/bin/python dorkinator.py example.com

# CSV for a tracker or spreadsheet
.venv/bin/python dorkinator.py example.com --format csv --output-dir exports

# Plain terminal output for CI, pipes, or logs
.venv/bin/python dorkinator.py example.com --no-color

Working with a scope file

Real testing scopes often include more than one domain. Put one domain on each line in a file, then pass that file to Dorkinator.

# scope.txt
example.com
example.org
.venv/bin/python dorkinator.py scope.txt --format csv --output-dir exports

The tool skips blank lines and comments, removes duplicates, and writes a separate export for each domain. It also validates domains before it generates anything, which helps catch a pasted URL or typo before your review becomes messy.

Optional local AI triage

The optional AI mode is for people who want help sorting public, in-scope search results after the query generation step. It needs Ollama and a local Qwen model. For free local search, it uses Docker to run SearXNG only on 127.0.0.1:8081. Port 8080 stays free for Burp Suite's usual proxy listener.

./install.sh --ai
.venv/bin/python dorkinator.py example.com --ai

Open Docker Desktop and wait for it to finish starting before you run the installer. It checks for Ollama, downloads qwen2.5:7b-instruct if needed, creates a private SearXNG secret, and starts the local search service. The model download is about 4.7 GB, so give it a little time and disk space.

If Homebrew reports externally-managed-environment, do not add — break-system-packages. Run ./install.sh again and use the .venv/bin/python command shown here. If port 8081 is already occupied, stop the service using it before running the installer again.

With AI mode enabled, Dorkinator searches each generated query, ignores results outside the target domain and its subdomains, then sends the remaining public page text to the local model. The triage report is saved as dorkinator-output/ai-triage.json.

Each item receives one of three labels:

  • no_finding: nothing obvious showed up in the page text.
  • possible_exposure: the page may contain something that needs manual validation.
  • review_needed: the model could not decide confidently, or a local dependency needs attention.

Treat all three as workflow labels, not security verdicts. A page marked possible_exposure might be harmless. A page marked no_finding can still deserve a look. Good testing still needs context, permission, and human judgement.

You can reduce the amount of work the AI does while you are learning:

.venv/bin/python dorkinator.py example.com --ai --ai-limit 10 --ai-results 3

— ai-limit caps the number of URLs triaged.

— ai-results controls how many search results Dorkinator collects for each query. The default search provider is local SearXNG when available. If you prefer Brave Search, set BRAVE_SEARCH_API_KEY and select it with — search-provider brave.

None

The browser workspace

The repository also includes a simple local browser workspace. Open index.html in a modern browser, enter an approved domain, choose Google or Bing, and generate a clickable collection.

It is handy when you want to explore visually instead of working from a terminal. You can copy search URLs or download the collection as TXT or JSON. Because it runs locally, it does not need a backend or account. Opening an individual search link is the point where your browser contacts the search engine.

A sensible workflow for beginners

If you are new to bug bounty or web recon, resist the urge to run every query and call it research. Start with a short, deliberate pass.

  1. Read the program's scope and rules first. Confirm the exact domains and subdomains you may test.
  2. Generate a text or CSV export for one approved domain.
  3. Begin with surface and API queries. These often give you a useful map of public documentation, staging references, and obvious application paths.
  4. Record what you checked, what you found, and why it may matter. A spreadsheet is enough.
  5. Validate carefully. An indexed filename, an old stack trace, or a string that resembles a key is not automatically a reportable issue.
  6. Stop when a result falls outside scope. Do not use the tool as permission to investigate unrelated systems.

That workflow is less flashy than a giant query dump, but it is how you build habits that hold up on real engagements.

A quick command reference

# Generate text links with Google
.venv/bin/python dorkinator.py example.com

# Use Bing and write JSON
.venv/bin/python dorkinator.py example.com --engine bing --format json

# Export a multi-domain scope file as CSV
.venv/bin/python dorkinator.py scope.txt --format csv --output-dir exports

# Disable terminal colour
.venv/bin/python dorkinator.py example.com --no-color

# Use local AI triage with conservative limits
.venv/bin/python dorkinator.py example.com --ai --ai-limit 10 --ai-results 3

Final note

Dorkinator will not replace curiosity, judgement, or a careful reading of scope. What it can do is remove some of the repetitive setup from public-surface discovery, keep your query collection organised, and give you a local option for triaging a manageable number of in-scope pages.

For beginners, that is plenty. Learn the query categories, understand why each result matters, and build a review process you can explain. The useful skill is not collecting the most tabs. It is knowing which ones deserve your attention.

— -

Dorkinator is released under the MIT License. Find the project on [GitHub] [Website]