Mastering Search Engines (Dorking)
Mastering Search Engines (Dorking) is a practitioner-level course covering the full spectrum of passive reconnaissance through advanced search engine operators. The course spans core search operator grammar and Boolean logic, structural operators for hunting misconfigured servers and leaked configuration files, web-scale subdomain and cloud storage discovery, code-based intelligence gathering on GitHub, and infrastructure-level fingerprinting with Shodan and Censys. Each section combines foundational operator syntax with operational tradecraft, closing with a hands-on, multi-platform demo.
What You'll Learn
- Explain how search engines crawl and index the web, and why dorking qualifies as passive reconnaissance with no direct footprint on target infrastructure.
- Apply strict search operator grammar (spacing rules, exact phrase matching, wildcards) and Boolean logic (AND, OR, NOT/-) to eliminate noise from search results.
- Use filetype:, inurl:, intitle:, intext:, and AROUND(X) operators to locate specific file types, URL structures, page metadata, and proximity-based credential leaks.
- Identify misconfigured Apache/Nginx servers, exposed .env/.conf/.yaml configuration files, and leaked log databases through structural dorking.
- Map an organization's attack surface using subdomain pruning, and audit cloud storage (Google Drive, Dropbox) and document platforms (Scribd, SlideShare) for accidental data exposure.
- Perform GitHub dorking to uncover hardcoded API keys and private cryptographic keys, and automate credential audits with tools like TruffleHog and git-secrets.
- Use Shodan and Censys to passively fingerprint internet-connected devices and correlate SSL/TLS certificates, discovering unpatched or exposed infrastructure without sending a single active scan packet.
- Implement defensive countermeasures (directory-indexing controls, robots.txt, noindex, X-Robots-Tag) and recognize the cognitive biases (novelty, confirmation, availability) that undermine analyst judgment.
- Chain GitHub, Google, and Censys dorking into a single end-to-end investigation through the course's hands-on infrastructure and data breach demo.
