Google Dorks for Bug Bounty Hunting 🕵️‍♂️

A comprehensive collection of Google dorks for ethical bug bounty hunters and security researchers.

---

📖 Table of Contents

• Basic Search Operators
• Sensitive Information Exposure
• Authentication & Authorization
• Database Exposure
• Error Messages & Debug Information
• Configuration Files
• File Upload & Directory Listings
• API & Endpoints
• Cloud & Storage Misconfigurations
• Injection Points
• Framework & CMS Specific
• Advanced Search Combinations
• Legal & Ethical Guidelines
• Tools & Resources

---

🔍 Basic Search Operators

Operator	Description	Example
site:	Limit to specific domain	site:example.com
inurl:	Search in URL	inurl:admin
intitle:	Search in page title	intitle:"index of"
intext:	Search in page content	intext:"password"
filetype:	Search by file type	filetype:pdf
ext:	Search by file extension	ext:sql
-	Exclude term	-wordpress
" "	Exact phrase match	"database password"
*	Wildcard	admin*
OR	Logical OR	php OR asp
AND	Logical AND	admin AND login
()	Group operators	(php OR asp) login

---

📄 Sensitive Information Exposure

Configuration Files

• site:target.com filetype:env DB_PASSWORD
• site:target.com "index of" ".env"
• site:target.com filetype:yml database
• site:target.com filetype:properties spring.datasource
• site:target.com "config.php" inurl:include
• site:target.com "application.yml" "password:"
• site:target.com "secrets.json" "api_key"
• site:target.com "docker-compose.yml" "environment"
• site:target.com ".htpasswd" intitle:"index of"
• site:target.com filetype:ini "database"

Backup Files

• site:target.com filetype:sql "INSERT INTO"
• site:target.com "index of" "backup.zip"
• site:target.com "database dump" "tar.gz"
• site:target.com filetype:dump "CREATE TABLE"
• site:target.com "backup.sql" "last modified"
• site:target.com filetype:bak inurl:web.config
• site:target.com "dump" "mysql" filetype:sql
• site:target.com "backup_" "daily" filetype:gz
• site:target.com "db_backup" filetype:rar
• site:target.com "weekly_backup" filetype:tar

Git & Version Control

• site:target.com "index of" "/.git"
• site:target.com filetype:git "HEAD" "refs"
• site:target.com "/.git/config" intitle:"index of"
• site:target.com "git clone" "target.com"
• site:target.com ".gitignore" "node_modules"
• site:target.com ".git/HEAD" "ref: refs"
• site:target.com ".git/logs/HEAD" intitle:"index"
• site:target.com ".svn/entries" "dir"
• site:target.com ".hg/store" "data"
• site:target.com "_git" intitle:"index of"

Log Files

• site:target.com filetype:log "error" "exception"
• site:target.com "access.log" "GET /admin"
• site:target.com "error.log" "PHP Notice"
• site:target.com filetype:txt "username" "password"
• site:target.com "debug.log" "wp-content"
• site:target.com "apache.log" "POST"
• site:target.com "auth.log" "Failed password"
• site:target.com "nginx.access.log" "200"
• site:target.com "laravel.log" "Stack trace"
• site:target.com "app.log" "ERROR"

---

🔐 Authentication & Authorization

Login Panels

• site:target.com inurl:/admin/login
• site:target.com intitle:"login" "username"
• site:target.com "admin panel" "password"
• site:target.com "sign in" "dashboard"
• site:target.com "authentication" "form"
• site:target.com "login.aspx" "password"
• site:target.com "auth" "signin"
• site:target.com "member login" "forgot"
• site:target.com "control panel" "admin"
• site:target.com "administrator" "login"

Default Credentials

• site:target.com "default password" "admin"
• site:target.com "username: admin" "password:"
• site:target.com "welcome" "your password is"
• site:target.com "initial setup" "temporary password"
• site:target.com "default credentials" "router"
• site:target.com "admin/admin" "login"
• site:target.com "root/root" "access"
• site:target.com "administrator/administrator" "panel"
• site:target.com "guest/guest" "login"
• site:target.com "user/user" "default"

---

🗄️ Database Exposure

phpMyAdmin & Adminer

• site:target.com inurl:phpmyadmin/index.php
• site:target.com "phpMyAdmin" "Welcome to"
• site:target.com inurl:adminer.php
• site:target.com "mysql management" "login"
• site:target.com "pma/" "cookie"
• site:target.com "dbadmin" "mysql"
• site:target.com "myadmin" "sql"
• site:target.com "database manager" "web"
• site:target.com "sqlbuddy" "index.php"
• site:target.com "phppgadmin" "postgresql"

MongoDB & NoSQL

• site:target.com "mongodb://" "password"
• site:target.com "27017" "mongod"
• site:target.com "mongo-express" "port:8081"
• site:target.com "rockmongo" "admin"
• site:target.com "mongoclient" "connect"
• site:target.com "mongodb" "unauthorized"
• site:target.com "mongod.conf" "bindIp"
• site:target.com "mongos" "port"
• site:target.com "nosql" "management"
• site:target.com "mongovue" "interface"

---

🚨 Error Messages & Debug Information

PHP Errors

• site:target.com "PHP Warning:" "include"
• site:target.com "mysql_fetch_array()"
• site:target.com "Undefined variable"
• site:target.com "Fatal error:" "require"
• site:target.com "PHP Parse error" "syntax"
• site:target.com "Notice: Undefined index"
• site:target.com "Warning: Cannot modify"
• site:target.com "PHP Error:" "log"
• site:target.com "exception" "PHP"
• site:target.com "display_errors" "On"

Stack Traces

• site:target.com "at line" "stack trace"
• site:target.com "exception" "in thread"
• site:target.com "java.lang.NullPointerException"
• site:target.com "python.traceback"
• site:target.com "Error stack trace:"
• site:target.com "StackTrace:" "at"
• site:target.com "Caused by:" "Exception"
• site:target.com "debug backtrace"
• site:target.com "call stack"
• site:target.com "traceback (most recent)"

---

📁 File Upload & Directory Listings

File Upload Vulnerabilities

• site:target.com inurl:/uploads/ filetype:php
• site:target.com "file uploaded successfully"
• site:target.com "choose file" "upload"
• site:target.com inurl:"/temp/" filetype:jsp
• site:target.com "upload.php" "submit"
• site:target.com "multipart/form-data" "upload"
• site:target.com "max-file-size" "upload"
• site:target.com "file upload" "restricted"
• site:target.com "upload image" "profile"
• site:target.com "browse..." "upload"

Directory Listings

• site:target.com intitle:"index of" "/images"
• site:target.com "Parent Directory" "/css"
• site:target.com "name" "last modified" "size"
• site:target.com "Directory listing for /"
• site:target.com "Index of /admin"
• site:target.com "[To Parent Directory]"
• site:target.com "Apache/2.4.7 Server at"
• site:target.com "nginx index of"
• site:target.com "listing directory" "enabled"
• site:target.com "no index file" "directory"

---

🔌 API & Endpoints

API Documentation

• site:target.com "swagger" "api"
• site:target.com "/api/v1/" "documentation"
• site:target.com "openapi.json" "paths"
• site:target.com "postman" "collection"
• site:target.com "apiary" "documentation"
• site:target.com "redoc" "OpenAPI"
• site:target.com "apidocs" "endpoints"
• site:target.com "REST API" "documentation"
• site:target.com "graphql" "playground"
• site:target.com "endpoint" "parameters"

---

💉 Injection Points

SQL Injection Parameters

• site:target.com inurl:"id=" "product"
• site:target.com "cat_id=" "order by"
• site:target.com "user_id=" "profile"
• site:target.com "article_id=" "view"
• site:target.com "news_id=" "detail"
• site:target.com "page_id=" "content"
• site:target.com "itemid=" "show"
• site:target.com "product_id=" "details"
• site:target.com "uid=" "user"
• site:target.com "pid=" "process"

XSS Vulnerable Parameters

• site:target.com "search?q="
• site:target.com "redirect?url="
• site:target.com "message=" "comment="
• site:target.com "name=" "form"
• site:target.com "email=" "contact"
• site:target.com "query=" "results"
• site:target.com "term=" "search"
• site:target.com "keywords=" "find"
• site:target.com "q=" "s="
• site:target.com "input=" "submit"

---

⚖️ Legal & Ethical Guidelines

✅ DO's

• Only test systems you own or have explicit written permission to test.
• Always add site:target.com to limit your search scope.
• Respect robots.txt files and security headers.
• Follow responsible disclosure practices.

---

🛠️ Tools & Resources

Recommended Tools

• GooDork - Automated Google dorking tool
• DorkScanner - Multi-engine dork scanner
• GitDorker - GitHub dorking tool
• Waybackurls - Historical URL discovery
• Gau - Fetch known URLs from AlienVault/Wayback
• ParamSpider - Parameter discovery

Learning Resources

• Google Hacking Database (GHDB) - Official Google dorks database
• OWASP Testing Guide - Web security testing guide
• PortSwigger Web Security Academy - Free web security training
• HackerOne Hacktivity - Public vulnerability reports

Bug Bounty Platforms

• HackerOne
• Bugcrowd
• OpenBugBounty
• Synack
• Intigriti

---

⚠️ Disclaimer: This information is for educational purposes only. The author assumes no liability for any misuse of this information. Always obtain proper authorization before testing any system. Unauthorized testing is illegal and unethical.

Happy (ethical) hunting! 🎯