Boolean searches or "Google Dorks" you should know

By default, Google tries to be as smart as possible to give us relevant answers to our questions. But sometimes searches don't lead to exactly the expected result...

Either because the words used have another strong context, or because our search is very precise!

This is the case in OSINT, where you search for private information within public data, for investigations for example...

Let's discover together the advanced search operators that work on Google, also called boolean searches (or Google Dorks).

Top 6

Exact search ("expression")

Have you ever tried searching for your name on Google? If you do, there's a good chance you won't find any results about you, because there's always some celebrity with a name almost like yours.

Personally, for a very long time it was "Nicholas Brendon", an American actor...

But if you run a search with a phrase between quotation marks, then only results containing EXACTLY these words will be returned!

Google > "Nicolas Brondin"

Excluding a term (-expression)

Some words are directly associated with several fields, and it's often the most popular field that comes up first. The "-" operator lets you exclude one or more terms from the results!

Google > Switch -Nintendo

By simply searching for the keyword "Switch", you'll come across the gaming console... But by excluding the term "Nintendo" from the query's answers, you'll land directly on results related to computing and programming.

File type (filetype:extension)

It's less common to search for a file directly on Google, simply because we don't always think it's possible... and yet it is!

The "filetype" operator lets you target a specific file type, whether it's an image, a video, a text file, pdf,... But the most powerful part is that if the text of this file has been indexed by Google, then you'll be able to target the content of it!

Google > "Confidential" filetype:pdf

Google will return all the files (publicly accessible) in pdf format whose text contains the keyword "Confidential"!

Targeting a site (site:url)

If you're looking for information on a specific site, then you can target that site using the domain name (or part of it).

Google > "Grève SNCF" site:gouv.fr

This example targets, for instance, ALL sites ending in .gouv.fr, meaning all sites belonging to the French government!

Targeting a url (inurl:path)

Just like the previous operator, "inurl" allows you to target not a domain name, but all the keywords contained in the url!

Google > inurl:wp-content site:gouv.fr

This query therefore returns all government sites containing a "wp-content" url, and thus running on Wordpress!

Specifying a date (before:YYYY-MM-DD)

Finally, you can select only the results that were published (or updated) before or after a certain date! Be careful, because some pages don't contain a publication date, and will therefore not be included in the result!

This is nevertheless very handy, for example for listing the pages of your site indexed, or not, by Google according to date.

Google > site:code-garage.fr before:2021
or
Google > site:code-garage.fr after:2023-01-01

As you can see, this operator works with a full date, or just a year, and lets you filter dates before (before), or after (after).

I hope this article was helpful to you, and see you soon on Code-Garage!