Free tool · osint720
Google Dork generatorfree, no sign-up
The OSINT720 generator builds advanced search queries (Google Dorks) to find what your company has exposed on the Internet: documents, login panels, directory listings or credentials. It is free, needs no account and works with Google, Bing and Startpage.
What is a Google Dork?
- A search that combines advanced operators (such as site:, filetype: or intitle:) to find very specific information indexed by search engines.
- Attackers use them to locate exposed documents and panels without touching the victim’s systems.
- Used on your own domains, they tell you what anyone can see.
How to use the generator
- 01
Type your domain
For example, yourcompany.com. Use only your own domains or ones you are authorised to test.
- 02
Choose what to look for
Documents, panels, credentials, backups or open directories, among other categories.
- 03
Run the search
Open each query in Google, Bing or Startpage and review the results.
- 04
Fix what shows up
Remove what is exposed, protect access and ask the search engine to clear its cache.
Dorks to audit your company
| Dork | What it finds | How to fix it |
|---|---|---|
| site:yourcompany.com filetype:pdf | Published PDF documents | Check whether any is internal and remove it |
| site:yourcompany.com ext:xls OR ext:xlsx OR ext:csv | Spreadsheets with data | Delete those with personal or internal data |
| site:yourcompany.com intitle:"index of" | Open directories | Disable directory listing on the server |
| site:yourcompany.com inurl:admin OR inurl:login | Login panels | Restrict access and enable MFA |
| site:yourcompany.com ext:sql OR ext:bak OR ext:zip | Backups and dumps | Take them off the web server |
| site:yourcompany.com ext:env OR ext:log | Configuration files and logs | Block them and rotate any keys they contain |
| "@yourcompany.com" filetype:xls | Lists of company email addresses | Remove them and warn about phishing risk |
Google search operators
| Operator | What it does | Example |
|---|---|---|
| site: | Limits the search to a domain | site:yourcompany.com |
| filetype: / ext: | Looks for a file type | filetype:pdf |
| intitle: | Looks for words in the title | intitle:"index of" |
| inurl: | Looks for words in the URL | inurl:login |
| "…" | Looks for the exact phrase | "internal use" |
| - | Excludes results | -site:www.yourcompany.com |
| OR | Joins two conditions | ext:doc OR ext:docx |
| before: / after: | Filters by date | after:2025-01-01 |
Responsible use
- Use it only on your own domains or with written authorisation.
- Seeing what a search engine already shows does not give you permission to download or use third-party data.
- If you find your company’s personal data exposed, treat it as a possible security incident.
Frequently asked questions about Google Dorks
Searching Google is legal. What is not allowed is accessing systems without authorisation or using third-party data. Use it on your own domains.
The free generator works without an account: it builds the queries and you open them in the search engine.
The generator gives you the queries; the OSINT720 analysis automates the search for subdomains, emails and leaks and prioritises the alerts.
Want the full analysis of your exposure?
OSINT720 reviews your company’s subdomains, exposed emails and leaks and gives you prioritised alerts.