Recon
Run a Google dork list through Custom Search
Repeatable Google dorking through a Custom Search Engine.
overview
What gorks does
gorks turns a curated Google dork list into a Recon step. You supply a JSON --dorks file, a --cseid, and an --api-key; it queries a Programmable Search Engine and collects matching pages.
Use it when exposed files, backups, and login pages may still sit in the public index. Routing through the official API avoids scraping the results page and the blocks that follow.
Scope with --siterestrict when the engine covers fewer than 10 domains. The managed node writes a file and folder of hits; for passive archive URL harvesting, prefer gau or waymore.
source github.com/carlospolop/gorks
use cases
Where gorks fits
Hunt for exposed files and pages
Run a dork list that targets index pages, backups, and config files through a Custom Search Engine to surface artifacts an organization left publicly indexable.
Make Google dorking repeatable
Keep the dork set in a JSON file so the same recon queries run identically on every engagement instead of being typed into a browser one at a time.
Scope a search engine to one target
Use siterestrict with a CSE that covers a small domain set so every dork stays inside the organization you are assessing.
Rotate API keys for volume
Supply a file of API keys so a large dork run spreads requests across credentials and keeps moving past per-key quotas.
reference
gorks inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| dorks | FILE | --dorks | JSON file of Google dork queries to run. |
| cse-id | STRING | --cseid | Id of the Custom Search Engine to query. |
| api-key | STRING | --api-key | API key for the Custom Search Engine. |
| api-keys-file | FILE | --api-keys-file | Read multiple API keys from a file to spread request volume. |
| siterestrict | BOOLEAN | --siterestrict | Use the siterestrict API when the engine covers fewer than 10 domains. |
| debug | BOOLEAN | --debug | Print debug output while queries run. |
Showing key inputs. gorks exposes 6 inputs in total.
example
Run gorks
# run a JSON dork list through a scoped Custom Search Enginegorks --dorks dorks.json --cseid a12bc3de4fg5hi6jk --api-key <GOOGLE_API_KEY> --siterestrict[+] site:example.com intitle:"index of" https://example.com/backup/ https://assets.example.com/old/[+] site:example.com filetype:env https://example.com/.env.bak[+] site:example.com inurl:wp-config https://blog.example.com/wp-config.php.save[+] site:example.com ext:sql "INSERT INTO" https://example.com/db/dump.sqlguidance
Choosing gorks
Use gorks for repeatable Google dorking through the Custom Search Engine API. You need a CSE id and an API key. For passive URL harvesting from web archives, reach for gau or waymore instead.
gau
Pulls known URLs from web archives passively. gorks searches live Google index results via dorks.
theharvester
Broad OSINT across many sources including search engines. gorks focuses on running a dork list.
urlhunter
Searches archived URL datasets for matches. Different angle on the same exposed-asset hunt.
faq
gorks questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run gorks yourself
A dorks file feeds gorks, which runs each query through a Custom Search Engine and writes the matching pages as a queryable output.
Facts on this page come from the live Trickest tool library.