Google Dorking – The Complete Guide to Advanced Search Operators

You're looking for your competitor's pricing page. Google returns their blog post about pricing philosophy, a G2 review mentioning their pricing, and a Reddit thread where someone is guessing at their pricing. The actual page is on page three.

That's a search problem, not a content problem. The page you want exists – Google just doesn't surface it without the right operators.

Google dorking is the practice of using advanced search operators to filter results with surgical precision. Competitive analysts use it to find competitor documents. Security researchers use it to identify exposed data. Recruiters use it to find candidates on platforms Google has indexed. The operators are the same for every use case: built into Google's standard interface, free, and almost entirely unused by the professionals who'd benefit most.

What is Google dorking? Google dorking (also called Google hacking) uses specific search syntax – operators like site:, filetype:, intitle:, and inurl: – to filter the search index with precision that a standard keyword query can't replicate. Each operator is a hard constraint. Stack several and you've built a research instrument from Google's own index, at no cost.

What can you find with Google dorking? Competitor pricing documents, sales presentations, analyst decks, buyer evaluation reports, historical cached pages, job postings that reveal product strategy, customer migration stories, and market sizing spreadsheets. In cybersecurity, dorking also surfaces exposed credentials, open directories, and misconfigured servers – the same technique, different queries.

Is Google dorking legal? Using search operators to find publicly indexed information is legal. Google's index only includes pages that servers have allowed to be crawled. You are not accessing private systems – you are querying what Google has already indexed. Accessing systems you are not authorised to use, regardless of how you found them, is a separate matter governed by computer misuse law.

What is Google dorking used for?

The operators are general-purpose. The use cases are defined by the queries you build.

• Competitive intelligence: Track competitor documents, pricing changes, and product direction. Find buyer evaluation reports that name your category. Surface migration discussions from prior customers. For a structured approach to turning these findings into ongoing intelligence, see our guide to how to find a competitor's strengths and weaknesses.

• Security research and penetration testing: Identify exposed configuration files, open directory listings, and inadvertently indexed credentials. Google dorking is a standard component of OSINT (open-source intelligence) workflows.

• Sales and GTM research: Find ICP signals, decision criteria documents, and category conversations that don't appear in curated databases.

• SEO and content research: Audit competitor content architecture, find indexing gaps, and identify keyword patterns across the category.

• Academic and investigative research: Locate primary source documents, government filings, and datasets that standard search buries.

If you’re not sure where to start, here’s a minimum-viable operator set for each use case:

The operators

1. filetype: – The document layer no one searches

Your industry's most valuable documents – analyst presentations, competitor decks, pricing models, capability statements – are indexed by Google and buried by standard search. The filetype: operator surfaces them.

Syntax: keyword filetype:extension

Extensions that matter: pdf, pptx, ppt, xlsx, xls, docx, csv

Example queries:

• [competitor name] filetype:pptx – conference decks and sales presentations

• "competitive landscape" filetype:pdf – market analysis documents from analysts and consultants

• pricing filetype:xlsx – spreadsheet-based pricing models left publicly accessible

Standard search optimizes for relevance to your query. filetype: optimizes for document type. The two sets of results rarely overlap.

→ Full breakdown: Searching by filetype: find hidden PDFs, PPTs and docs in seconds

2. site: – Search a domain you don't own

site: restricts your search to a single domain. You're scanning one company's entire public footprint – their indexed pages, documents, and subdomains – without navigating their site structure.

Syntax: site:domain.com keyword

Example queries:

• site:competitor.com pricing – their pricing page, even if it's not linked from the homepage

• site:competitor.com filetype:pdf – every document they've published

• site:linkedin.com "[Company Name]" "VP of Product" – recent senior hires revealing strategic priorities

Pair site: with filetype: and you've built a document scanner for any domain on the internet.

3. intitle: – The difference between "mentions" and "is about"

Standard Google search surfaces pages that mention your keyword. intitle: surfaces pages whose primary focus is your keyword. If a term is in the <title> tag, the author considered it the point.

Syntax: intitle:keyword

Example queries:

• intitle:"pricing" site:competitor.com – pricing pages, not blog posts that happen to mention pricing

• intitle:"competitive landscape" site:competitor.com – their internal market framing

• intitle:"implementation guide" filetype:pdf [your category] – vendor documentation across your space

allintitle: extends this to multiple required words: allintitle:competitive intelligence best practices returns pages where all three appear in the title.

4. inurl: – Let URL structure do the filtering

URL paths signal intent. /case-studies/ is conversion content. /blog/ is acquisition content. /resources/ is enablement content. inurl: lets you filter by those structural signals directly.

Syntax: inurl:keyword

Example queries:

• inurl:pricing site:competitor.com – direct hit on pricing-architecture URLs

• inurl:case-study "[your industry]" – case study libraries across competitors

• inurl:changelog site:competitor.com – their product release history

allinurl: requires all specified words to appear in the URL: allinurl:competitive intelligence tools returns pages where every term is in the URL path.

5. intext: – Find mentions in body content

intext: retrieves pages where the keyword appears in the body text, not the title. Lower precision, higher recall – useful for pulling competitive mentions, migration narratives, and data points that wouldn't be in a headline.

Syntax: intext:keyword

Example queries:

• intext:"we switched from [competitor]" – unsolicited customer migration stories

• intext:"[your category]" "annual contract value" filetype:pdf – documents discussing ACV in your space

• site:reddit.com intext:"[competitor] vs" – organic comparison threads

allintext: requires all terms to appear in the body: allintext:competitive intelligence template framework returns pages containing every word in the body copy.

6. cache: – Read pages that have been changed or removed

When a competitor adjusts pricing, removes an announcement, or takes down a page, Google's cached snapshot often preserves what was there. cache: retrieves it.

Syntax: cache:domain.com/path

Example queries:

• cache:competitor.com/pricing – their pricing as of Google's last crawl

• cache:competitor.com/blog/[post-slug] – a removed announcement

Cache availability varies – Google doesn't cache everything, and snapshots may be days or weeks old. For historical records beyond Google's cache window, Wayback Machine alternatives fill the gap.

7. " " – When close isn't good enough

Quotation marks force Google to return only results containing your exact phrase – no semantic interpretation, no related results. Standard search guesses at intent; quotes demand a literal match.

Syntax: "exact phrase"

Example queries:

• "[competitor name]" "cancelled" site:reddit.com – churn conversations naming the competitor

• "net revenue retention" filetype:pdf – documents using this specific KPI term

• "we chose" OR "we selected" "[your category]" -site:vendor.com filetype:pdf – buyer evaluation documents

8. OR – Search multiple terms in one query

OR (uppercase) returns results containing either term. Use it when a concept has multiple names, or when you want to sweep across several framings without running separate queries.

Syntax: term1 OR term2

Example queries:

• site:competitor.com (pricing OR plans OR packages) – any URL pattern they use for pricing

• "competitive intelligence" OR "competitive analysis" filetype:pdf – both phrasings of the same workflow

• "churned" OR "cancelled" OR "switched away" [competitor] site:reddit.com – churn signal in all common phrasings

9. - (minus) – Cut the aggregators

The minus operator excludes results containing a term. Review aggregators, academic repositories, and news archives dominate results for competitive queries. Minus strips them out.

Syntax: keyword -unwanted_term

Example queries:

• competitive intelligence tools -site:g2.com -site:capterra.com -site:trustradius.com – direct results only

• "market sizing" filetype:pdf -site:academia.edu – industry models, not academic papers

• intitle:"pricing" site:competitor.com -inurl:blog – pricing pages, not pricing blog posts

Stack as many exclusions as needed. There's no documented limit.

10. .. – Searchable number ranges

.. returns results containing numbers between two values. Useful for quantitative research: funding rounds, ARR data, headcount, pricing brackets.

Syntax: keyword $low..$high

Example queries:

• "series A" "$5M..$30M" site:techcrunch.com – funding rounds in a specific bracket

• "ARR" "$10M..$100M" filetype:pdf – documents discussing mid-market ARR figures

• intitle:"top 5..20 [category] tools" – list posts covering your competitive space

11. * – Wildcard for unknown words

* acts as a placeholder for any word in a phrase. Use it when you know the structure of a query but not every term in it.

Syntax: "known * unknown"

Example queries:

• "* alternatives to [competitor]" – any phrasing of alternative-search queries

• "[competitor] is * than [your product]" – comparison claims in any direction

• "best * software for [your category]" – surfaces category terminology across vendors

12. related: – Find sites publishing similar content

related: returns domains Google considers topically similar to the URL you specify. Useful for competitive landscape mapping and finding sites you haven't considered.

Syntax: related:domain.com

Example queries:

• related:competitor.com – domains competing in a similar content or product space

• related:g2.com – other software review and comparison sites

• related:forrester.com – analyst and research firms covering similar territory

Results vary by domain authority. Works best on well-indexed, content-rich domains.

13. before: / after: – Filter by date

before: and after: restrict results to pages indexed before or after a specific date. Essential for tracking how competitor content, pricing, or messaging changed over a defined window.

Syntax: keyword before:YYYY-MM-DD or keyword after:YYYY-MM-DD

Example queries:

• site:competitor.com/pricing before:2024-01-01 – their pricing page as it was discussed prior to 2024

• "[category]" "market sizing" filetype:pdf after:2023-06-01 – recent industry reports only

• intitle:"[competitor]" after:2025-01-01 before:2025-06-01 – coverage in a specific six-month window

Combine before: and after: in the same query to set a bounded date range.

14. AROUND(N) – Find terms in proximity

AROUND(N) returns results where two terms appear within N words of each other. Standard search doesn't guarantee proximity. AROUND enforces it – useful when you need two concepts to appear together, not just anywhere on the page.

Syntax: term1 AROUND(N) term2

Example queries:

• "competitive intelligence" AROUND(5) "template" – pages where these terms appear close together, not in unrelated sections

• "[competitor]" AROUND(3) "pricing" – pages where the competitor is discussed specifically in the context of pricing

• "churn" AROUND(4) "reason" – churn cause analysis in reviews and teardowns

N is the maximum word distance. AROUND(3) is tight; AROUND(10) gives more flexibility.

15. info: – Retrieve Google's data on a URL

info: returns a summary of what Google knows about a specific URL: cached version, similar pages, and pages that link to it. It's a quick diagnostic for any page in the index.

Syntax: info:domain.com/path

Example queries:

• info:competitor.com – Google's snapshot of their homepage: indexing status, cache, and related pages

• info:competitor.com/pricing – quick check on how Google sees their pricing page

• info:your-own-domain.com – diagnostic view of your own indexing status

Less useful for research sweeps, but valuable for page-level diagnostics and confirming a specific URL is indexed.

16. ~ – Synonym search

The tilde operator instructs Google to include synonyms and related terms alongside your keyword. Useful when the concept you're researching has multiple labels across the industry.

Syntax: ~keyword

Example queries:

• ~"competitive intelligence" filetype:pdf – also returns results for competitive analysis, market intelligence, competitive research

• ~pricing site:competitor.com – also returns plans, packages, cost, rates

• "go-to-market" ~strategy filetype:pptx – captures decks using strategy, approach, plan, framework

Note: ~ is less reliable than it was historically. Where synonym coverage matters, OR with explicit terms is more predictable.

The combination layer: where search becomes research

Single operators narrow. Combinations do the work of a research function.

Competitor document scanner:
site:competitor.com (filetype:pdf OR filetype:pptx OR filetype:xlsx)
Every document type they've published, in one query.

Buyer decision document finder:
"we evaluated" OR "we chose" "[category]" filetype:pdf -site:vendor.com
Procurement documents from buyers in your space who published their process.

Churn and migration sweep:
intext:"switched from [competitor]" OR intext:"moved off [competitor]" site:reddit.com OR site:news.ycombinator.com
Organic migration conversations, unfiltered.

Pricing intelligence sweep:
intitle:pricing (site:competitor1.com OR site:competitor2.com OR site:competitor3.com)
All competitors' pricing pages in a single query. For what to do once you spot a change, see how to monitor competitor pricing pages automatically.

Hiring as product signal:
site:linkedin.com OR site:greenhouse.io "[competitor]" ("machine learning" OR "AI") "engineer"
Hiring patterns in specific technical areas reveal product direction before any announcement. Job posting patterns are one of the strongest event-based buying signals – they tell you what a company is building six to twelve weeks before they announce it.

Category conversation finder:
"[your category]" (intext:"we use" OR intext:"we rely on" OR intext:"we switched to") site:reddit.com OR site:news.ycombinator.com
Organic product adoption conversations, not review-site content.

ICP document sweep:
"[ICP job title]" "[your category]" filetype:pdf after:2023-01-01
Recent documents authored by or targeting your ideal buyer profile.

Competitive analyst deck finder:
"[your category]" ("competitive landscape" OR "market map" OR "vendor comparison") filetype:pptx after:2022-01-01
Conference and analyst presentations framing your space.

Pricing change tracker:
site:competitor.com/pricing before:2024-06-01
Cached and indexed versions of pricing pages from before known repositioning.

Partner and integration signal:
site:competitor.com ("integrations" OR "partners" OR "ecosystem") after:2024-01-01
Recent partner page changes that reveal ecosystem strategy.

Operator quick reference

Running searches versus building a research system

A dork query run once is a data point. A repeatable set of queries – run monthly, timestamped, compared over time – is a signal layer.

Define a cadence. Four sweeps cover the core intelligence surface:

1. Competitor document scan: site:competitor.com (filetype:pdf OR filetype:pptx) – run monthly, log new documents

2. Pricing page sweep: intitle:pricing site:competitor.com + cache:competitor.com/pricing – flag changes

3. Migration story search: intext:"switched from [competitor]" across Reddit and HN – track sentiment shift

4. Hiring signal audit: site:linkedin.com OR site:greenhouse.io "[competitor]" [role keywords] – identify strategic direction before press releases

What changes between runs is where the intelligence lives. The operators surface the data. The cadence converts it into pattern. Pattern is what informs positioning decisions. If you're building this into a repeatable workflow, a competitive assessment matrix gives you a structure for logging and comparing what each sweep reveals over time.

Frequently asked questions

Is Google dorking illegal?
Using search operators to query Google's public index is legal. You're not accessing private systems – you're filtering what Google has already crawled and indexed with permission from each server. Accessing any system you are not authorised to use, regardless of how you found it, falls under computer misuse legislation in most jurisdictions – but that applies to access, not to the search.

Is Google dorking ethical?
Operators used to research publicly available information for competitive, journalistic, or academic purposes are considered standard professional research. Using dorking to find credentials, personal data, or security vulnerabilities for exploitation crosses into unethical and illegal territory. The technique is neutral; the query determines the ethics.

Does Google dorking work on search engines other than Google?
Most operators (site:, filetype:, intitle:, inurl:) work on Bing, DuckDuckGo, and Yandex with similar syntax. cache:, AROUND(N), and related: are Google-specific. Results differ significantly because each engine indexes and weights pages differently – Google's index is the broadest, which is why most practitioners start there.

What are the limits of Google dorking?
Google's index is large but not complete. Pages blocked by robots.txt, pages behind authentication, and recently published content not yet crawled won't appear in results. Google also rate-limits automated or repeated queries – running large dork sweeps programmatically triggers CAPTCHAs or temporary blocks. For automated monitoring at scale, tools like Shodan, SpiderFoot, or purpose-built CI platforms handle what manual dorking can't.

How is Google dorking different from regular Google search?
Standard Google search interprets your query semantically – it infers intent and returns what it considers relevant. Operators bypass interpretation. filetype:pdf doesn't ask Google what it thinks is relevant; it instructs Google to return only PDFs. The difference is instruction versus suggestion.

Can Google dorking be used for SEO?
Yes. Common SEO applications include: auditing which pages are indexed (site:yourdomain.com), finding duplicate content ("exact paragraph from your page" -site:yourdomain.com), researching competitor content architecture (site:competitor.com inurl:blog), and identifying thin or orphaned pages the site didn't intend to surface.

How do organisations protect against Google dorking?
The primary protection is controlling what Google indexes. This means configuring robots.txt to disallow sensitive directories, using <meta name="robots" content="noindex"> on pages that should not be public, moving sensitive files behind authentication, and auditing what your domain exposes with site:yourdomain.com searches on a regular basis. If a file is accessible without a login, assume Google will index it.

What tools work alongside Google dorking?
For CI teams: the Wayback Machine and alternatives (historical snapshots), SpiderFoot (automated OSINT), and Zimt (structured signal tracking across competitors). For security: Shodan (internet-connected device index), Censys, and FOCA (metadata extraction from indexed documents). For SEO: Screaming Frog (site audits that complement site: queries).