01 · Product name
Google Hacking Database
A catalog of search operators, maintained by Exploit-DB.
Published by Offensive Security.
In short
The Google Hacking Database (GHDB) is a free catalog of search queries — “dorks” — grouped by what they tend to find, such as files, login pages, and error messages. Offensive Security maintains it on Exploit-DB. It does not run the searches for you. A query is not authorization to access a system, download private data, or attack anything the result points at.
Product pricing strategy
02
Free
Google Hacking Database is free. You do not buy a seat to use what the project publishes.
Yes. The GHDB on Exploit-DB is free to read. Google’s own search limits still apply when you run queries.
Utility and features
03
Google’s operators are ordinary search syntax: site:, filetype:, intitle:, inurl:. The GHDB collects examples researchers have used to find pages that were public but should not have been interesting. That makes it a reference for defenders reviewing their own domains and a risky toy if you treat every row as a target list.
- What a dork is. A search query with operators. The GHDB stores examples and categories. Google runs the query when you choose to send it.
- Defensive use. Point operators at domains you own or are paid to assess. Look for exposed files, staging hosts, and error pages. Then close them.
- The line. Finding a public URL can be research. Using it to break in, skip an access control, or take data is not a search problem. Stop at the URL.
Use the categories to learn what operators exist. Then write your own queries against domains in scope. site:yourdomain.com filetype:pdf is a reasonable way to see public documents. A query aimed at someone else’s admin interface is not “just OSINT” once you start logging in, bypassing paywalls, or pulling data a normal visitor was not meant to take. The Wayback Machine is the companion when the page has since changed. Osint Daily does not reprint exploit-style dorks on this page.
- 1
Read the GHDB categories to learn operator patterns. Do not mass-run the list.
- 2
On a domain you are allowed to assess, try narrow operators such as site: and filetype: for public documents.
- 3
Open results as a normal visitor would. If a page asks you to authenticate, do not bypass it.
- 4
Record the query, the date, and what you closed or reported.
Caveats
04
The Google Hacking Database is a catalog of search queries, historically associated with Johnny Long and now mirrored in places such as Exploit-DB’s GHDB. The queries find what a search engine has already indexed. They do not bypass authentication.
Results go stale as indexes change. A query that once found directory listings may now find nothing, or find a different site that copied the same phrase. Use them on assets you are allowed to review. Do not automate a hundred dorks against organizations you do not work for.
Screenshots
05
Potential use cases
06
- You want public documents on a site you administer. Take a dork from the Google Hacking Database that matches the file type, add your site: operator, and run it in a normal search engine. The output is public URLs the index already has. Pivot a dead URL to the Wayback Machine. A dork is a query, not a vulnerability, and a result on someone else’s site is not yours to download in bulk.
- You are learning operators before a case needs them. Pick three entries, run them against a site you control, and write down what the index returned. The output is skill, plus a list of your own exposed files if you actually left any. Do not practice on a stranger’s domain because the database makes the query easy.
- A staging hostname might be indexed. Search the hostname, not a generic dork. If it appears, the output is a URL and a snippet. Pivot to Wayback if the page has since gone. Tell the owner. An indexed staging site is a configuration problem, not an invitation to log in with default credentials. This page does not describe how to do that.
Hard cases
The case where the first result is easy to over-read.
A dork returns a file that is not yours
The query was meant for your company and a similar filename on another domain appears. Leave it. Refine with site:. If the file is clearly someone else’s confidential document, do not download a copy ‘for the report.’ The finding, if you report it at all, is the URL and the fact that a search engine indexed it. Wayback is the pivot only when you need to see a page you were allowed to see and the live URL has gone.
Questions
Is the Google Hacking Database free?
Yes. The GHDB on Exploit-DB is free to read. Google’s own search limits still apply when you run queries.
Are Google dorks legal?
Using public search operators is not the same thing as breaking into a system. Legality depends on what you do next and where you are. Keep queries to assets you are allowed to assess, and do not bypass access controls.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Google Hacking Database
https://www.exploit-db.com/google-hacking-database