What is Google Hacking Database?
The Google Hacking Database (GHDB) is a categorised index of search engine queries designed to find sensitive information that was made public by mistake, such as exposed directories, login portals, error messages and files containing passwords. These queries are known as Google dorks. Each entry lists the query, its category, the author and the date it was added.
Johnny Long popularised Google hacking in the early 2000s and started the database. He handed it to OffSec in November 2010, and it is now maintained as part of the free, non-profit Exploit Database. It now includes queries for other search engines such as Bing and repositories such as GitHub. Defenders use it to check whether their own sites leak data that search engines have indexed.
Main Features
- Thousands of search queries grouped by category
- Categories such as sensitive directories, vulnerable files, login portals and error messages
- Filter by date added, category and author
- Queries for Google plus other engines and repositories like Bing and GitHub
- Community submissions, reviewed and published by OffSec
- Free and part of the Exploit Database
How to Get Started with Google Hacking Database
- Open the Google Hacking Database on exploit-db.com.
- Filter by category or search for a keyword to find relevant queries.
- Adapt a query with site: restrictions to check only domains you own or are authorised to assess.
- Fix or remove anything exposed, and ask search engines to drop it from their index.
Google Hacking Database Pricing
The Google Hacking Database is completely free. It is provided as a public service by OffSec as part of the non-profit Exploit Database.
Who Should Use It?
- Security teams checking what their sites leak into search engines
- Penetration testers on authorised engagements
- Researchers and journalists studying data exposure
- Web administrators auditing their own servers
- Students learning search engine reconnaissance
Google Hacking Database Alternatives
- OSINT Framework: a free map of OSINT tools that also flags Google dork resources.
- Shodan: a search engine for exposed devices and services rather than web pages.
- Wayback Machine: the Internet Archive's record of web pages, useful for seeing what was published in the past.
Frequently Asked Questions
Is Google Hacking Database free?
Yes. The Google Hacking Database is free to browse and search on exploit-db.com, with no account needed. It is a public service run by OffSec.
Is it legal to use Google dorks?
Running a search query is generally legal, and the GHDB is widely used for defensive audits. Using the results to access, download or exploit systems or data you are not authorised to use can be illegal, so limit your checks to your own sites or authorised engagements.
Who maintains the Google Hacking Database?
Johnny Long started the database, and in November 2010 he handed it to OffSec, which maintains it as part of the Exploit Database.