Yesterday, I told myself I would write a good, detailed article on 'Google Dorking'… and here it is. I get a lot of text messages from people asking, "How do you find vulnerabilities daily ?" And my answer is always the same "Google Dorking."

This article will give you exactly what you want to get started; i always say that google dorking is an art… it's one of the most powerful recon techniques in bug bounty hunting; if you know how to use it properly.

In simple terms, Google Dorking is the practice of using advanced Google search operators to find hidden, sensitive, or unintended information on websites that normal searches won't reveal.

Before you can start leveraging google dorks, you need to understand what "sensitive information" means… what are you actually hunting for ? is it login portals, configuration files, exposed documents, or database backups ? knowing what constitutes a "find" will guide your entire process and help you craft effective searches/dorks.

This is the most important tip I can give you; whenever you want to do google dorking, you need to have an objective, a goal, a focus. This focus is what will help you craft a precise dork.

If your focus is to find authentication pages, you craft your dork based on that focus. Example `site:example.com ("login"|"signup"|"register"|"logout"|"signin")`

If your focus is newsletter functionalities, you do the same. Example `site:example.com ("subscribe"|"newsletter"|"unsubscribe")`

The same logic applies to whatever you're focusing on, this could be admin panels, specific file types, error messages, etc… having a clear goal is the compass that will guide your dork crafting.

You might be tempted to just copy and paste a list of google dorks you found online, and while that isn't necessarily bad, especially if you understand what each dork is doing… i will always stand by this statement,

"Crafting your own dork is much more powerful than copy-pasting random ones."

Let's say I use the dork `site:example.com "signup"` and I find a vulnerable signup page, then, I try `site:example.com intext:"signup"` and that same vulnerable page doesn't show up. This shows that one dork can be more powerful than another; all you need to do is to refine your dork.

The same goes for `site:example.com` versus `site:*.example.com`; one might find subdomains that the other misses. If you understand this need for refinement, you will definitely be ahead of the game.

I once told a friend who wanted to learn, "If you know what to find, the game is yours."

Crafting dorks is a skill. The more you adjust them, the more it gives you access to the kingdom.

I'll end here for now, but expect this article to get updates from time to time as I add more insights.

Now, go hack.