Day 9: Google Dorking & OSINT — How to Find Publicly Exposed Information Like a Pro (2026)

Google Dorking isn’t about hacking Google. It’s about using Google’s own features — features designed for finding specific types of content — to surface information that organisations accidentally expose to the public internet. Login pages left unprotected. Configuration files indexed by crawlers. Sensitive documents uploaded to public servers. Internal directories browsable without authentication.

I always tell students: the best recon happens before you touch a network. Everything you learn from Google, WHOIS, certificate transparency, and LinkedIn requires zero interaction with the target’s systems — meaning it’s completely passive, creates no logs on their end, and gives you intelligence that shapes everything you do next.

What Is OSINT — And Why Every Pentest Starts Here

OSINT stands for Open Source Intelligence — information gathered from publicly available sources. The term comes from intelligence agencies, where “open source” means publicly accessible rather than classified. In ethical hacking, OSINT is the passive reconnaissance phase — you learn as much as possible about a target without sending a single packet to their network.

Why does it come first? Because the more you know going in, the more targeted and efficient your active testing becomes. A company’s tech stack, their employee names and emails, their domain structure, their software versions, their publicly exposed files — all of this shapes your attack surface map before you’ve written a single command. Intelligence professionals have a saying: “Time spent in reconnaissance is seldom wasted.” It applies equally here.

Core Google Search Operators — The Building Blocks

Google search operators are special commands that filter and target search results with precision. You’ve probably used some of them without knowing they were called “operators.” In security work, we combine them to find very specific types of content. Here are the operators every ethical hacker needs to know.

Dorking by Category — What Security Professionals Actually Look For

Now let’s combine those operators into real dork queries, organised by what they find. In an authorised security assessment, these help you understand what a target has accidentally exposed. I’ve structured these by category so you understand the intent behind each query — not just the syntax.

🗂️ Finding Exposed Files & Documents

🔓 Finding Login Pages & Admin Panels

📁 Finding Open Directories

🖥️ Finding Exposed Technology & Error Pages

🔑 Finding Credentials & API Keys in Public Code

The Google Hacking Database — 10,000+ Ready-Made Dorks

You don’t need to build every dork from scratch. The Google Hacking Database (GHDB) — maintained by Exploit-DB — is an archive of thousands of proven dork queries, each tagged by category. Security researchers contribute their discoveries and the database grows continuously.

Beyond Google — The OSINT Toolkit

Google is powerful but it’s just the start. Professional OSINT uses a collection of tools — each surfacing a different type of publicly available information. All of these tools work with data that’s already public; none of them require touching the target’s systems.

TOOL
Shodan — The Internet’s Device Search Engine

Shodan is a search engine that continuously scans the internet and indexes what it finds — not web pages, but the services running on open ports. It is the most powerful passive reconnaissance tool for finding internet-connected devices, exposed services, and vulnerable systems — all without touching anything yourself.

TOOL
theHarvester — Email Addresses & Subdomains

theHarvester automates the collection of email addresses, subdomains, and employee names from search engines, LinkedIn, and DNS. It’s pre-installed on Kali and produces structured output you can use directly in follow-on social engineering assessments or subdomain scanning.

WHOIS & Certificate Transparency — Domain & Subdomain Intelligence

🗺️ Complete OSINT Workflow — The Professional Approach

Here’s how I structure OSINT for a real security assessment. Every step feeds information into the next — building a complete picture before a single active scan is run. I want you to use this same structure during your Day 9 task.

🎯 Day 9 Practical Task — OSINT on a Permitted Target

For today’s tasks we use your own domain (if you have one), or practice on domains explicitly created for security training practice. Do not run OSINT workflows on organisations without authorisation — even passive techniques can create paper trails.

Frequently Asked Questions — Day 9