Post cover image

September 4, 2026

10 Google Dorks Every Bug Bounty Hunter Should Know

Discover the Google Dorks I use during reconnaissance to uncover publicly indexed pages, files, and endpoints more efficiently.

By Monika

4 min read

When I first started learning bug bounty hunting, I thought reconnaissance was only about collecting subdomains and scanning websites.

But after reading bug bounty write-ups and watching experienced researchers, I realized many of them used Google Dorks as one of the first steps in their reconnaissance process.

At first, I assumed Google Dorks were complicated.

In reality, they're just advanced search operators that help you find publicly indexed information more efficiently.

Over time, Google Dorking became a regular part of my workflow because it often reveals pages and files that aren't easy to discover through normal browsing.

In this article, I'll share 10 Google Dorks that I frequently use during reconnaissance and explain when each one is useful.

Important: Always use Google Dorks responsibly and only for reconnaissance on systems you own or are authorized to test.

What Are Google Dorks?

Google Dorks are advanced search operators that allow you to filter Google's search results.

Instead of searching for a website normally, you can search for:

  • Login pages
  • PDF files
  • Configuration files
  • Directory listings
  • Specific file extensions
  • API documentation
  • Admin panels

Since these pages are already indexed by Google, you're only searching publicly available information.

1. Find Everything From One Domain

site:example.com
None

This is the first dork I use.

It shows pages that Google has indexed for a particular domain.

It's useful for understanding the size of a website before beginning reconnaissance.

2. Find Login Pages

site:example.com inurl:login
None

Many web applications contain login portals that aren't immediately visible from the homepage.

This dork helps locate authentication pages quickly.

3. Find Admin Panels

site:example.com inurl:admin
None

Admin interfaces often have different functionality than public pages.

Finding them early helps map the application's attack surface.

4. Discover PDF Documents

site:example.com filetype:pdf
None

PDF files sometimes contain:

  • Internal documentation
  • User manuals
  • Employee information
  • Technical documentation

These documents can provide valuable context during reconnaissance.

5. Find JavaScript Files

site:example.com ext:js
None

JavaScript files often reveal:

  • API endpoints
  • Hidden routes
  • Configuration values
  • Third-party services

I always review JavaScript files during reconnaissance.

6. Search for Backup Files

site:example.com ext:zip OR ext:bak

Backup files occasionally appear in search results if they have been indexed.

While uncommon, they're worth checking during reconnaissance.

7. Find Directory Listings

site:example.com intitle:"index of"
None

Misconfigured web servers sometimes expose directory listings.

These can reveal downloadable files, logs, or application resources.

8. Search for API Endpoints

site:example.com inurl:api
None

Many modern applications expose REST APIs.

Finding these endpoints early helps you understand how the application communicates.

9. Find Configuration Files

site:example.com ext:xml

Configuration or sitemap files sometimes reveal additional URLs that aren't easily accessible through navigation.

10. Find Pages Containing Specific Keywords

site:example.com "password reset"
None

Searching for specific text can help locate:

  • Password reset pages
  • User documentation
  • Support portals
  • Help pages

This is useful when looking for particular application features.

Combining Google Dorks

You don't have to use only one search operator.

For example:

site:example.com inurl:admin ext:php

Or:

site:example.com intitle:"login" filetype:php

Combining operators helps narrow search results and find exactly what you're looking for.

Save Time with XNLDorker

While Google Dorks work well manually, checking every dork across multiple search engines can become repetitive.

That's one reason I started using XNLDorker. It lets me run dorks against multiple search engines and save all discovered URLs into a single file, making reconnaissance much more organized.

GitHub - xnl-h4ck3r/xnldorker: Gather results of dorks across a number of search engines Gather results of dorks across a number of search engines - xnl-h4ck3r/xnldorker

My Bug Bounty Workflow

This is how I usually begin reconnaissance:

  1. Run Google Dorks.
  2. Collect interesting URLs.
  3. Use httpx to identify live hosts.
  4. Crawl applications with Katana.
  5. Search archived URLs with waymore.
  6. Discover hidden parameters using Arjun.
  7. Begin manual testing.

Starting with Google Dorks often gives me a better understanding of the application's public footprint before running additional tools.

Tips for Beginners

If you're new to Google Dorking, here are a few suggestions:

  • Start with simple operators like site: and inurl:.
  • Save interesting URLs for later review.
  • Check JavaScript files whenever you find them.
  • Read publicly available documentation carefully.
  • Always respect the target's scope and authorization.

Good reconnaissance isn't about collecting thousands of URLs. It's about identifying the ones that deserve closer inspection.

My Experience

Google Dorking has become one of the easiest ways for me to discover useful information before launching any automated tools.

Sometimes I find login pages, documentation, or JavaScript files within minutes.

Other times, I don't discover anything interesting.

Either way, it only takes a few minutes, which makes it a valuable first step in my reconnaissance workflow.

Final Thoughts

Google Dorks won't automatically find vulnerabilities, but they can help you uncover publicly indexed information that supports a more effective reconnaissance process.

Combined with tools like httpx, Katana, waymore, Cariddi, and Arjun, they provide a solid foundation for understanding a target before beginning manual security testing.

Remember, responsible reconnaissance is about gathering information ethically and only on systems where you have permission to perform security testing.

Need Help?

If you have any questions about Google Dorking or run into issues while setting up the tools mentioned in this article, feel free to reach out.

Connect with me

X (Twitter): @Commanak46

I'll do my best to help.

Happy hunting! ✨