google-dorks-catalog

1# Google Dorks Catalog -- Exposed Configs & Secrets
2 
3## When to Use
4 
5- During **passive reconnaissance** (Phase 1) on every target
6- After crt.sh subdomain enumeration
7- Before any active scanning
8- Validated against 100+ real targets
9 
10## Prerequisites
11 
12- Explicit authorization, target boundaries, and rate limits for the target.
13- Tooling: `curl`, `openssl`, `python3`.
14- A writable evidence directory: `export OUTPUT_DIR="${OUTPUT_DIR:-./output}" && mkdir -p "$OUTPUT_DIR"`.
15- For any state-changing step (writes, uploads, credential attempts), obtain explicit confirmation immediately before the command.
16 
17## How to Run
18 
19```bash
20# Set once per engagement; every step below uses these.
21TARGET="example.com"   # or the engagement target
22export OUTPUT_DIR="${OUTPUT_DIR:-./output}"
23 
24# Test dork results manually
25curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/.env" | head -5
26# Verify GitHub found secrets
27python3 -c "import json; print(json.loads(open('result.json').read()))"
28```
29 
30## Procedure
31 
32The phases below are the procedure. Keep each probe bounded (`--max-time`), record evidence beneath `OUTPUT_DIR`, and stop at the stop-conditions listed in Pitfalls.
33 
34## High-Precision Dorks
35 
36### Critical Exposed Files
37 
38```
39site:$target "APP_KEY"
40site:$target "DB_PASSWORD"
41site:$target "-----BEGIN RSA PRIVATE KEY-----"
42site:$target filetype:env
43site:$target inurl:git/config
44site:$target intitle:"index of" ".env"
45site:$target "api_key" OR "apikey" OR "secret_key"
46…