Google Dorks List and Updated Database for Files Containing Usernames and Passwords in 2024

14 min read
Last updated: Oct 13, 2024

google-dork-list

How to Use Google Dorks?

To use a Google Dork, you simply type in a Dork into the search box on Google and press “Enter”. Here are some of the best Google Dork queries that you can use to search for information on Google.

Google Dork Queries Examples:

  • site:.edu “phone number”– This Dork searches for websites on .edu domains that contain the words “phone number”. student “phone number” – This Dork searches for websites on .edu domains that contain the words “student” and “phone number”.
  • inurl:edu “login” – This Dork searches for websites on .edu domains that contain the words “login”. This Dork searches for school websites that contain student login information.
  • “powered by vbulletin” site:.edu – This Dork searches for websites on .edu domains that contain the words “powered by vbulletin”. This Dork searches for school websites that are running on the vbulletin forum software.
  • “powered by vbulletin” site:.gov – This Dork searches for websites on .gov domains that contain the words “powered by vbulletin”. This Dork searches for governmental websites that are running on the vbulletin forum software.
  • “powered by vbulletin” site:.mil – This Dork searches for websites on .mil domains that contain the words “powered by vbulletin”. This Dork searches for military websites that are running on the vbulletin forum software.
  • “powered by vbulletin” inurl:.edu – This Dork searches for websites on .edu domains that contain the words “powered by vbulletin”. This Dork searches for school websites that are running on the vbulletin forum software.
  • “powered by vbulletin” inurl:.mil – This Dork searches for websites on .mil domains that contain the words “powered by vbulletin”. This Dork searches for military websites that are running on the vbulletin forum software.
  • inurl:.com “powered by vbulletin” – This Dork searches for websites on .com domains that contain the words “powered by vbulletin”. This Dork searches for websites that are running on the vbulletin forum software.
  • inurl:.edu “register forum” – This Dork searches for websites on .edu domains that contain the words “register forum”. This Dork searches for school websites that allow you to register for a forum.
  • inurl:.gov “register forum” – This Dork searches for websites on .gov domains that contain the words “register forum”. This Dork searches for governmental websites that allow you to register for a forum.

Scraper API provides a proxy service designed for web scraping. With over 20 million residential IPs across 12 countries, as well as software that can handle JavaScript rendering and solving CAPTCHAs, you can quickly complete large scraping jobs without ever having to worry about being blocked by any servers.

Google Dorks Updated Database for Files Containing Usernames:

intitle:"index of" "/usernames"
intext:"-----BEGIN CERTIFICATE-----" ext:txt
intitle:"index of" "contacts.txt"
intitle:"index of" "db.properties" | "db.properties.BAK"
intitle:"index of" "credentials.xml" | "credentials.inc" | "credentials.txt"
jdbc:sqlserver://localhost:1433 + username + password ext:yml | ext:java
intitle:"index of" "password.yml
"'dsn: mysql:host=localhost;dbname=" ext:yml | ext:txt "password:"
intitle:"index of" "sitemanager.xml" | "recentservers.xml"
intitle:"index of" "filezilla.xml"
"DefaultPassword" ext:reg "[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]"
inurl:user intitle:index of ext:sql | xls | xml | json | csv
filetype:csv intext:"Secret access key"
jdbc:mysql://localhost:3306/ + username + password ext:yml | ext:java -git -gitlab
intitle:"index of" "/parameters.yml*"
"CREATE ROLE" + "ENCRYPTED PASSWORD" ext:sql | ext:txt | ext:ini -git -gitlab
File contains Sensitive Information
"index of" "users.frm"
intitle:"index of" "tomcat-users.xml"
intitle:"index of" "/ftpusers"
intitle:"index of" "users.sql"
allintext:username filetype:log
intitle:"index of" service.grp
intitle:index.of "users.db"
"username.xlsx" ext:xlsx
inurl:/_layouts/mobile/view.aspx?List=
"authentication failure; logname=" ext:log
inurl:/profile.php?lookup=1
intext:"root:x:0:0:root:/root:/bin/bash" inurl:*=/etc/passwd
inurl:"/root/etc/passwd" intext:"home/*:"
site:extremetracking.com inurl:"login="
intext:"SteamUserPassphrase=" intext:"SteamAppUser=" -"username" -"user"
inurl:root.asp?acs=anon
filetype:conf inurl:proftpd.conf -sample
filetype:log username putty
filetype:reg reg +intext:"internet account manager"
filetype:reg reg HKEY_CURRENT_USER username
+intext:"webalizer" +intext:"Total Usernames" +intext:"Usage Statistics for"
inurl:php inurl:hlstats intext:"Server Username"
index.of perform.ini
"index of" / lck
inurl:admin inurl:userlist
inurl:admin filetype:asp inurl:userlist
intitle:index.of .bash_history
intitle:index.of .sh_history

Google Dorks Updated Database for Files Containing Passwords:

intitle:"Index of" htpasswd
intitle:"Index of" pwd.db
site:rentry.co intext:"password"
site:pastebin.com "admin password"
site:controlc.com intext:"password"
site:pastebin.com "password"
site:pastebin.com intext:pass.txt
intext:"Index of" intext:"password.zip"
intext:"index of" "uploads"
intext:"password" | "passwd" | "pwd" site:ghostbin.com
site:pastebin.com intext:password.txt
intext:"/pfx-password.txt" "[To Parent Directory]"
site:pastebin.com intext:username | password | SECRET_KEY
inurl:/wp-content/uploads/ ext:txt "username" | "user name" | "uname" | "user" | "userid" | "user id" AND "password" | "pass word" | "pwd" | "pw"
inurl:password site:shodan.io
intitle:"index of" "passwrod*"
intitle:"index of" "credentials"
allintext:password filetype:log after:2018
"index of /" +passwd
intitle: "Index of ftp passwords"
Inurl: "login" Intitle:index of username and pass
inurl:wp-config.php.save
"enable secret 5" ext:txt | ext:cfg
filetype:log username admin
site:pastebin.com intitle:"password" 2021
inurl:/wp-content/uploads/data.txt
allintext:"*.@gmail.com" OR "password" OR "username" filetype:xlsx
inurl:/wp-content/uploads/ ext:txt "username" AND "password" | "pwd" | "pw"
"# -FrontPage-" ext:pwd inurl:(service | authors | administrators | users) "# -FrontPage-" inurl:service.pwd
site:*.blob.core.windows.net ext:xls | ext:xlsx (login | password | username)
"public $user =" | "public $password = " | "public $secret =" | "public $db =" ext:txt | ext:log -git
intitle:"index of" "application-users.properties" | "mgmt-users.properties" | "*standalone.xml"
"cpanel username" "cpanel password" ext:txt
"insert into users" "VALUES" ext:sql | ext:txt | ext:log | ext:env
"password 7" ext:txt | ext:log | ext:cfg
intitle:"index of" "idx_config"
"mailer_password:" + "mailer_host:" + "mailer_user:" + "secret:" ext:yml
intext:construct('mysql:host
"define('SECURE_AUTH_KEY'" + "define('LOGGED_IN_KEY'" + "define('NONCE_KEY'" ext:txt | ext:cfg | ext:env | ext:ini
"keystorePass=" ext:xml | ext:txt -git -gitlab
"define('DB_USER'," + "define('DB_PASSWORD'," ext:txt
intitle:"index of" "anaconda-ks.cfg" | "anaconda-ks-new.cfg"
intitle:"index of" "config.exs" | "dev.exs" | "test.exs" | "prod.secret.exs"
jdbc:oracle://localhost: + username + password ext:yml | ext:java -git -gitlab
jdbc:postgresql://localhost: + username + password ext:yml | ext:java -git -gitlab
jdbc:mysql://localhost:3306/ + username + password ext:yml | ext:javascript -git -gitlab
"spring.datasource.password=" + "spring.datasource.username=" ext:properties -git -gitlab
ext:log password END_FILE
site:pastebin.com intext:admin.password
"db.username" + "db.password" ext:properties
ext:cfg "g_password" | "sv_privatepassword" | "rcon_password" -git -gitlab
"server.cfg" ext:cfg intext:"rcon_password" -git -gitlab
"anaconda-ks.cfg" | "ks.cfg" ext:cfg -git -gitlab
rootpw --iscrypted ext:cfg
"admin_password" ext:txt | ext:log | ext:cfg
"index of" "password.ini"
filetype:log intext:password after:2015 intext:@gmail.com | @yahoo.com | @hotmail.com
"'username' =>" + "'password' =>" ext:log
ext:txt intext:@yahoo.com intext:password
intitle:"database.php" inurl:"database.php" intext:"db_password" -git -gitlab
ext:xls intext:@gmail.com intext:password
"POSTGRES_PASSWORD=" ext:txt | ext:cfg | ext:env | ext:ini | ext:yml | ext:sql -git -gitlab
"/** MySQL database password */" ext:txt | ext:cfg | ext:env | ext:ini
"EMAIL_HOST_PASSWORD" ext:yml | ext:env | ext:txt | ext:log
allintext:"redis_password" ext:env
intext:"db_database" ext:env intext:"db_password"
"Index of" "/yahoo_site_admin/credentials"
intitle:"index of" "/master.passwd"
allintext:password filetype:log
inurl:logs intext:GET https:// ext:txt intext:password intext:username
"MYSQL_ROOT_PASSWORD:" ext:env OR ext:yml -git
filetype:env "DB_PASSWORD"
"config.php.bak" intitle:"index of"
intext:"Index of /password"
"index of" ".env"
intitle:"index of" "config.neon" OR "config.local.neon"
intitle:"index of" "passwords.xlsx"
inurl:*helpdesk* intext:"your default password is"
"MasterUserPassword" ext:cfg OR ext:log OR ext:txt -git
"/etc/shadow root:$" ext:cfg OR ext:log OR ext:txt OR ext:sql -git
intitle:"index of " "*.passwords.txt"
intitle:"index of" "db.ini"
"super password level 3 cipher" ext:txt OR ext:log
"admin password irreversible-cipher" ext:txt OR ext:log OR ext:cfg
intitle:"index of" application.ini
intitle:"index of" "database.ini" OR "database.ini.old"
intitle:"index of" "db.connection.js"
"create account" admin ext:cfg
"d-i passwd/root-password-crypted password" ext:cfg
"configure account user encrypted" ext:cfg
intitle:"Index of" dbconnect.inc
intext:authentication set encrypted-password ext:cfg
"enable password" ext:cfg -git -cisco.com
password console-password ext:cfg -git
intitle:"index of" "credentials.yml"
intitle:"index of" "passwords.yml"
intext:"WPENGINE_SESSION_DB_USERNAME" || "WPENGINE_SESSION_DB_PASSWORD"
intext:"username=" AND "password=" ext:log
intitle:index.of "creds.txt"
intitle:"index of" share.passwd OR cloud.passwd OR ftp.passwd -public
intitle:"index of" "db.conf"
intitle:"Index of" password.txt
"contrasena" filetype:sql -github.com
intext:"@gmail.com" intext:"password" inurl:/files/ ext:txt
intitle:"index of" "ftp.passwd"
intitle:"index of" "htpasswd.txt"
"pass" "usuario" filetype:sql
intext:"aspx" filetype:txt login & password
inurl:users.json + "username"
intext:"wordpress" filetype:xls login & password
s3 site:amazonaws.com filetype:xls password
inurl:login.txt filetype:txt
intitle:settings.py intext:EMAIL_USE_TLS -git -stackoverflow
inurl:wp-config.php intext:DB_PASSWORD -stackoverflow -wpbeginner
intitle:settings.py intext:EMAIL_HOST_PASSWORD -git -stackoverflow
username | password inurl:resources/application.properties -github.com -gitlab
filetype:xml config.xml passwordHash Jenkins
intext:jdbc:oracle filetype:java
filetype:txt $9$ JunOS
filetype:reg reg HKEY_CURRENT_USER intext:password
inurl:"standalone.xml" intext:"password>"
/_wpeprivate/config.json
inurl:"build.xml" intext:"tomcat.manager.password"
intitle:"index of" intext:login.csv
inurl:"trello.com" and intext:"username" and intext:"password"
inurl:"wp-license.php?file=../..//wp-config"
"battlefield" "email" site:pastebin.com
inurl:wp-config.bak
intext:"rabbit_password" | "service_password" filetype:conf
"whoops! there was an error." "db_password"
intext:"login" department | admin | manager | company | host filetype:xls | xlsx -community -github
intext:"please change your" password |code | login file:pdf | doc | txt | docx -github
inurl:configuration.php and intext:"var $password="
inurl:/dbcp.properties + filetype:properties -github.com
intext:define('AUTH_KEY', ' wp-config.php filetype:txt
inurl:wp-config-backup.txt
"password.xlsx" ext:xlsx
filetype:env intext:REDIS_PASSWORD
site:showmyhomework.co.uk/school/homeworks/ "password"
intitle:"index.of" inurl:"cvs" login | passwd | password | access | pass -github -pub
filetype:doc inurl:"gov" intext:"default password is"
site:trello.com intext:mysql AND intext:password -site:developers.trello.com -site:help.trello.com
intext:"PuTTY log" ext:log "password" -supportforums -github
inurl:"/App.Config" + ext:config + "password=" -github -git
intitle:"Index of" intext:"Login Data"
inurl:"servlet/ViewFormServlet?" "pwd"
Codeigniter filetype:sql intext:password | pwd intext:username | uname intext: Insert into users values
intitle:"index.of" "places.sqlite" "key3.db" -mozilla.org
intitle:"index.of" "places.sqlite" "Mail" thunderbird -mozilla.org -scan
filetype:config "" "password" "web.config" -stackoverflow -youtube.com -github
ext:ini Robust.ini filetype:ini "password"
inurl:"config.xml" "password" ext:xml -stackoverflow.com -github.com
inurl:"databases.yml" ext:yml password -github
inurl:/host.txt + filetype:txt + "password"
intitle:"Index Of" intext:".vscode"
intitle:"index of /" inanchor:.kdbx
site:pastebin.com "rcon_password"
CakePHP inurl:database.php intext:db_password
intext:password inurl:"/log/production" ext:log
"database_password" filetype:yml "config/parameters.yml
"MAIL_PASSWORD" filetype:env
"database_password" filetype:yml "config/parameters.yml"
intitle:"Index Of" intext:sftp-config.json
ext:config + " password=" + "
"password" + ext:conf "Modem Type = USB Modem"
ext:inf SetupMgrTag AdminPassword
"enable secret" ext:cfg -git -cisco.com
inurl:"gradle.properties" intext:"proxyPassword"
site:trello.com password
intext:connectionString & inurl:web & ext:config
intitle:"Index Of" intext:.ftpconfig
inurl:_vti_pvt/administrators.pwd
inurl:"sitemanager.xml" ext:xml -git
intext:DB_PASSWORD || intext:"MySQL hostname" ext:txt
site:pastebin.com intext:"*@*.com:*"
"resources.db.params.password" ext:ini -git
"iSpy Keylogger" "Passwords Log" ext:txt
"mysqli_connect" ext:inc
ext:reg " [HKEY_CURRENT_USER\Software\ORL\WinVNC3]" -git
" End Stealer " ext:txt
"FileZilla" inurl:"recentservers.xml" -git
"Stealer by W33DY" ext:txt
inurl:"/zebra.conf" ext:conf -git
ext:fetchmailrc
"[main]" "enc_GroupPwd=" ext:txt
"-----BEGIN RSA PRIVATE KEY-----" ext:key
filetype:bak inurl:php "mysql_connect"
"# -FrontPage-" ext:pwd
"INSERT INTO phpbb_users" ext:sql
"END_FILE" inurl:"/password.log"
"Index of" "logins.json" "key3.db"
inurl:"-wp13.txt"
"your default password is" filetype:pdf
site:cloudshark.org/captures# password
intitle:"index of/" CCCam.cfg
inurl:github.com intitle:config intext:"/msg nickserv identify"
inurl:proftpdpasswd
inurl:"/wp-content/wpclone-temp/wpclone_backup/"
site:static.ow.ly/docs/ intext:@gmail.com | Password
site:github.com ext:csv userid | username | user -example password
intext:"eav" filetype:txt
filetype:pcf "cisco" "GroupPwd"
site:pastebin.com intext:@gmail.com | @yahoo.com | @hotmail.com daterange:2457388-2457491
intext:"END_FILE" ext:log
inurl:wp-config -intext:wp-config "'DB_PASSWORD'"
"Password=" inurl:web.config -intext:web.config ext:config
inurl:wp-content/uploads filetype:xls | filetype:xlsx password
intext:"GET http://" ext:txt intext:"password" inurl:log
intext:http | https intext:login | logon intext:password | passcode filetype:xls | filetype:xlsx
ext:sql intext:username intext:password
inurl:"ftp" intext:"user" | "username" | "userID" | "user ID" | "logon" | "login" intext:"password" | "passcode" filetype:xls | filetype:xlsx
intext:smtp | pop3 intext:login | logon intext:password | passcode filetype:xls | filetype:xlsx
ext:xls intext:NAME intext:TEL intext:EMAIL intext:PASSWORD
inurl:etc -intext:etc ext:passwd
filetype:log intext:password | pass | pw
intext:@pwcache "parent directory"
site:pastebin.com intext:Username
intext:DB_PASSWORD ext:env
ext:csv intext:"password"
ext:sql intext:"alter user" intext:"identified by"
inurl:"security/xamppdirpasswd.txt"
inurl:yahoo_site_admin/credentials/
"automatic teller" "operator manual" "password" filetype:pdf
inurl:ws_ftp.ini "[WS_FTP]" filetype:ini
xamppdirpasswd.txt filetype:txt
inurl:typo3conf/localconf.php
inurl:/backup intitle:index of backup intext:*sql
filetype:password jmxremote
site:github.com inurl:sftp-config.json intext:/wp-content/
ext:sql intext:@gmail.com intext:password
site:github.com inurl:sftp-config.json
"BEGIN RSA PRIVATE KEY" filetype:key -github
filetype:sql insite:pass && user
ext:sql intext:@hotmail.com intext :password
filetype:config inurl:web.config inurl:ftp
filetype:inc OR filetype:bak OR filetype:old mysql_connect OR mysql_pconnect
ext:xml ("proto='prpl-'" | "prpl-yahoo" | "prpl-silc" | "prpl-icq")
allinurl:"User_info/auth_user_file.txt"
inurl:"/dbman/default.pass"
"parent directory" proftpdpasswd intitle:"index of" -google

A Google Dork is a search query that looks for specific information on Google’s search engine. Google Dorks are developed and published by hackers and are often used in “Google Hacking”.

Google Dorks are extremely powerful. They allow you to search for a wide variety of information on the internet and can be used to find information that you didn’t even know existed.

Because of the power of Google Dorks, they are often used by hackers to find information about their victims or to find information that can be used to exploit vulnerabilities in websites and web applications.

Google Search Engine is designed to crawl anything over the internet and this helps us to find images, text, videos, news and plethora of information sources. With it’s tremendous capability to crawl, it indexes data along the way, which also includes sensitive information like email addresses, login credentials, sensitive files, website vulnerabilities, and even financial information. In many cases, We as a user won’t be even aware of it.

Google Dork is a search query that we give to Google to look for more granular information and retrieve relevant information quickly. For example, try to search for your name and verify results with a search query [inurl:your-name]. Analyse the difference. You just have told google to go for a deeper search and it did that beautifully.

Search Operators :

  • cache:

    • [cache:www.google.com web] will show the cached content with the word “web” highlighted. This functionality is also accessible by clicking on the “Cached” link on Google’s main results page. The query [cache:] will show the version of the web page that Google has in its cache. For instance, [cache:www.google.com] will show Google’s cache of the Google homepage.

  • link:

    • [link:www.google.com] will list webpages that have links pointing to the Google homepage.

  • related:

    • [related:www.google.com] will list web pages that are similar to the Google homepage.

  • info:

    • [info:www.google.com] will show information about the Google homepage.

  • define:

    • The query [define:] will provide a definition of the words you enter after it, gathered from various online sources. The definition will be for the entire phrase entered (i.e., it will include all the words in the exact order you typed them). Eg: [define:google]

  • stocks:

    • If you begin a query with the [stocks:] operator, Google will treat the rest of the query terms as stock ticker symbols, and will link to a page showing stock information for those symbols. For instance, [stocks: intc yhoo] will show information about Intel and Yahoo. (Note you must type the ticker symbols, not the company name.)

  • site:

    • If you include [site:] in your query, Google will restrict the results to those websites in the given domain. For instance, [help site:www.google.com] will find pages about help within www.google.com. [help site:com] will find pages about help within .com urls. Note there can be no space between the “site:” and the domain.

  • allintitle:

    • If you start a query with [allintitle:], Google will restrict the results to those with all of the query words in the title. For instance, [allintitle: google search] will return only documents that have both “google” and “search” in the title.

  • intitle:

    • If you include [intitle:] in your query, Google will restrict the results to documents containing that word in the title. For instance, [intitle:google search] will return documents that mention the word “google” in their title, and mention the word “search” anywhere in the document (title or no). Putting [intitle:] in front of every word in your query is equivalent to putting [allintitle:] at the front of your query: [intitle:google intitle:search] is the same as [allintitle: google search].

  • allinurl:

    • If you start a query with [allinurl:], Google will restrict the results to those with all of the query words in the url. For instance, [allinurl: google search] will return only documents that have both “google” and “search” in the url. Note that [allinurl:] works on words, not url components. In particular, it ignores punctuation. Thus, [allinurl: foo/bar] will restrict the results to page with the words “foo” and “bar” in the url, but won’t require that they be separated by a slash within that url, that they be adjacent, or that they be in that particular word order. There is currently no way to enforce these constraints.

  • inurl:

    • If you include [inurl:] in your query, Google will restrict the results to documents containing that word in the url. For instance, [inurl:google search] will return documents that mention the word “google” in their url, and mention the word “search” anywhere in the document (url or no). Putting “inurl:” in front of every word in your query is equivalent to putting “allinurl:” at the front of your query: [inurl:google inurl:search] is the same as [allinurl: google search].

Google search service is never intended to gain unauthorised access of data but nothing can be done if we ourselves kept data in the open and do not follow proper security mechanisms.

Essentially emails, username, passwords, financial data and etc. shouldn’t be available in public until and unless it’s meant to be. Example, our details with the bank are never expected to be available in a google search. But our social media details are available in public because we ourselves allowed it.

Ending Note

Google Search is very useful as well as equally harmful at the same time. Because it indexes everything available over the web.

You need to follow proper security mechanisms and prevent systems to expose sensitive data. Follow OWASP, it provides standard awareness document for developers and web application security.

Scraper API provides a proxy service designed for web scraping. With over 20 million residential IPs across 12 countries, as well as software that can handle JavaScript rendering and solving CAPTCHAs, you can quickly complete large scraping jobs without ever having to worry about being blocked by any servers.

Note: By no means Box Piper supports hacking. This article is written to provide relevant information only. Always adhering to Data Privacy and Security.

Any thoughts, let's discuss on twitter

Sharing this article is a great way to educate others like you just did.



If you’ve enjoyed this issue, do consider subscribing to my newsletter.


Subscribe to get more such interesting content !

Tech, Product, Money, Books, Life. Discover stuff, be inspired, and get ahead. Box Piper is on Twitter and Discord. Let's Connect!!

To read more such interesting topics, let's go Home

More Products from the maker of Box Piper:

Follow GitPiper Instagram account. GitPiper is the worlds biggest repository of programming and technology resources. There is nothing you can't find on GitPiper.

Follow SharkTankSeason.com. Dive into the riveting world of Shark Tank Seasons. Explore episodes, pitches, products, investment details, companies, seasons and stories of entrepreneurs seeking investment deals from sharks. Get inspired today!.


Scraper API

More Blogs from the house of Box Piper: