loading
Loading content
loading
Recon
Repeatable Google dorking through a Custom Search Engine.
overview
gorks turns a curated Google dork list into a Recon step. You supply a JSON --dorks file, a --cseid, and an --api-key; it queries a Programmable Search Engine and collects matching pages.
Use it when exposed files, backups, and login pages may still sit in the public index. Routing through the official API avoids scraping the results page and the blocks that follow.
Scope with --siterestrict when the engine covers fewer than 10 domains. The managed node writes a file and folder of hits; for passive archive URL harvesting, prefer gau or waymore.
source github.com/carlospolop/gorks
use cases
Run a dork list that targets index pages, backups, and config files through a Custom Search Engine to surface artifacts an organization left publicly indexable.
Keep the dork set in a JSON file so the same recon queries run identically on every engagement instead of being typed into a browser one at a time.
Use siterestrict with a CSE that covers a small domain set so every dork stays inside the organization you are assessing.
Supply a file of API keys so a large dork run spreads requests across credentials and keeps moving past per-key quotas.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| dorks | FILE | --dorks | JSON file of Google dork queries to run. |
| cse-id | STRING | --cseid | Id of the Custom Search Engine to query. |
| api-key | STRING | --api-key | API key for the Custom Search Engine. |
| api-keys-file | FILE | --api-keys-file | Read multiple API keys from a file to spread request volume. |
| siterestrict | BOOLEAN | --siterestrict | Use the siterestrict API when the engine covers fewer than 10 domains. |
| debug | BOOLEAN | --debug | Print debug output while queries run. |
Showing key inputs. gorks exposes 6 inputs in total.
example
# run a JSON dork list through a scoped Custom Search Enginegorks --dorks dorks.json --cseid a12bc3de4fg5hi6jk --api-key <GOOGLE_API_KEY> --siterestrict[+] site:example.com intitle:"index of" https://example.com/backup/ https://assets.example.com/old/[+] site:example.com filetype:env https://example.com/.env.bak[+] site:example.com inurl:wp-config https://blog.example.com/wp-config.php.save[+] site:example.com ext:sql "INSERT INTO" https://example.com/db/dump.sqlguidance
Use gorks for repeatable Google dorking through the Custom Search Engine API. You need a CSE id and an API key. For passive URL harvesting from web archives, reach for gau or waymore instead.
Pulls known URLs from web archives passively. gorks searches live Google index results via dorks.
Broad OSINT across many sources including search engines. gorks focuses on running a dork list.
Searches archived URL datasets for matches. Different angle on the same exposed-asset hunt.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A dorks file feeds gorks, which runs each query through a Custom Search Engine and writes the matching pages as a queryable output.
Facts on this page come from the live Trickest tool library.