Google Dorking: OSINT with Advanced Search Operators

Typing a few words into a search engine and looking at the first page shows you a tiny part of the web. With advanced search operators (dorks) you can narrow a search to a specific site, file type, page title or date range. This guide covers the most useful operators, example queries and the limits to keep in mind.

Basic operators

• Quotes ("..."): Searches for the exact phrase. "Ahmet Yılmaz" returns pages where the two words appear side by side.
• Minus (-): Excludes a word. jaguar -car leaves the results about the animal.
• OR: Searches for either option. "port" OR "terminal"
• site: Limits the search to a site or domain ending. site:gov.tr, site:reddit.com
• filetype: Returns specific file types. filetype:pdf, filetype:xlsx
• intitle: Requires the word to appear in the page title.
• inurl: Requires the word to appear in the address.
• before: / after: Narrows Google results by date. after:2024-01-01 before:2024-06-30

Combining operators

The real power comes from using operators together. Each new operator cuts the number of results and brings you closer to what you are looking for.

• site:gov.tr filetype:pdf "faaliyet raporu" 2025: 2025 annual reports of Turkish public bodies.
• site:linkedin.com/in "OSINT" "Istanbul": public profiles of people working on OSINT in Istanbul.
• "username" -site:instagram.com: places where a username appears outside Instagram.
• intitle:"press release" "company name" after:2025-01-01: a company’s recent press releases.
• site:example.com -inurl:www: a good start for discovering a site’s subdomains.

Dork types: a ready-made query library

The queries below are grouped by type of research. Replace the example values in quotes (Company Name, example.com, username) with your own. Treat each query as a starting point; add or remove operators based on the results.

1. Documents and files

• site:example.com filetype:pdf: every PDF on a site (reports, brochures, presentations).
• site:example.com (filetype:xlsx OR filetype:csv): spreadsheets and data files.
• "Company Name" filetype:pptx: presentations that mention the company.
• site:gov.uk filetype:pdf "annual report" 2025: annual reports of public bodies.

2. Companies and organisations

• "Company Name" (site:linkedin.com/company OR site:linkedin.com/in): the company page and public employee profiles.
• "Company Name" (tender OR contract) site:gov.uk: public tenders and contracts.
• "Company Name" (fraud OR complaint OR lawsuit): adverse media and complaints.
• "Company Name" -site:example.com: what others write about the company outside its own site.

3. Usernames and social media

• "username" (site:reddit.com OR site:github.com OR site:medium.com): a username’s traces on forums, code and blogs.
• site:x.com "username": posts on X that mention the username.
• site:t.me "keyword": public Telegram channels and groups.
• site:instagram.com "place name": public posts about a place.

4. Location and images

• "place name" "city" (site:tripadvisor.com OR site:foursquare.com): visitor photos and reviews of a place.
• site:flickr.com "street name" "city": photos of a street from different angles.
• "text on the sign" "city": the fastest way to locate a sign seen in a photo.
• site:wikimapia.org "place name": buildings and facilities that are not named on maps.

5. Time and news

• "event" after:2025-03-01 before:2025-03-08: what was written in the first week of an event.
• "event" site:reuters.com: searching a news agency’s archive.
• intitle:"breaking" "place name" after:2025-01-01: breaking news about a place.
• "quoted sentence" before:2024-01-01: finding when a quote or claim first appeared.

6. Domains and infrastructure

• site:*.example.com -site:www.example.com: discovering subdomains.
• "example.com" -site:example.com: pages elsewhere that mention the site.
• site:example.com inurl:blog OR inurl:news: the site’s blog and news sections.
• site:example.com intitle:"our team" OR intitle:"about us": pages about the team and the organisation.

7. Maritime

• "IMO 1234567": every source that mentions a ship by its IMO number.
• "ship name" (site:marinetraffic.com OR site:vesselfinder.com): the ship’s pages on tracking sites.
• "ship name" filetype:pdf: port reports, inspection records and accident reports.

For more on researching ships, see our ship tracking guide.

A type to know about but not to use

One kind of dork is aimed at finding file directories, configuration files and admin panels left open on the internet by mistake. Security researchers use these queries only on systems they are authorised to test. We do not include such examples in this guide; if you want to check your own organisation’s site, do it together with your IT team.

Do not rely on one search engine

Each search engine has a different index and different operator support. What you cannot find on Google you may find on Bing, Yandex or DuckDuckGo. Bing and Yandex support site: and quotes; Yandex can give better results for Russian and Eastern European sources. Repeat an important search in at least two engines.

Read the results correctly

• The result count is an estimate; “about 1,200 results” is not the real number.
• Search engines can change results by person, language and location. Searching in a private window gives more neutral results.
• A page may have dropped out of the index but still be online, or appear in the index but be gone. In the second case, check the web archives.

Ethical and legal limits

Dorks sometimes turn up files, admin panels or lists of personal data that were left open by mistake. A file showing up in a search engine does not give you the right to download and use it. In Türkiye, accessing an IT system without permission is a crime under Article 243 of the Turkish Penal Code, and unlawfully obtaining and spreading personal data is a crime under Articles 135 and 136; most countries have similar laws.

Use search techniques to research documents, organisations and events, not to monitor people. For the general framework, see our What is OSINT guide.