What Is Google Dorking? Google Dorks for Sales and Competitor Research

Google dorks are advanced search queries, built from operators like site:, filetype:, and intitle: that filter results, that surface public information a plain keyword search buries. Running them is called Google dorking. Sales, marketing, and SEO teams use them to find decision-maker contacts, competitor pricing pages, public directories, and industry PDFs. Octoparse is a web data platform with a ready-made Google Search Scraper template built for exactly this: you give it the dork, it collects the results across as many pages as you set, and it hands back a spreadsheet, or feeds the data straight into your own systems by API. Security teams and OSINT researchers have used the same operators for years. The queries themselves are legal; what you do with the results is where the line sits, and this guide stays on the white-hat side of it.

Most guides on this topic are written for security researchers. This is the business version. Every dork here targets information a company chose to publish, and the sections below draw a hard line at anything gated. We ran every operator and example against live Google results in August 2026, so the notes on what still works, and what Google has quietly retired, are current. In a hurry? Jump to the copy-paste cheat sheet.

Quick answer: the eight operators that do most of the work

Combine two or three and you get a search precise enough to build a prospect list or a competitor price file from a single results page. Octoparse’s Google Search Scraper template then exports the whole result set to a spreadsheet in one run, which is the workflow the rest of this guide builds toward.

What is Google dorking?

Google dorking, also called Google hacking, is advanced searching: you hand Google a query built from operators rather than plain words, and it returns a narrow slice of its index that a normal search would drown out. A single operator string is a “dork.” The dorking meaning that matters here is plain: a repeatable advanced search that pulls one specific kind of public page.

The name traces to security researcher Johnny Long, who began collecting operator strings around 2002. That collection became the Google Hacking Database, now hosted at Exploit-DB, which holds thousands of documented queries. Most of those entries hunt for exposed systems, which is why the whole subject reads as security work. The mechanic itself is neutral. site:octoparse.com filetype:pdf is a dork, and it only returns PDFs that Octoparse already published.

Two properties make dorking useful for business research. First, it reaches pages that rank too low to ever surface in a normal search, so a supplier directory entry on page nine becomes findable. Second, it filters by structure, not just topic: you can ask for “spreadsheets on this domain that mention an email address” instead of hoping the right page floats up. In practice it is a lightweight front end for web scraping: the dork finds the pages, and a scraper pulls the fields off them.

Is Google dorking legal?

Running an advanced search is legal. You are using Google’s own documented features on its public index, and the results are pages the site owners let search engines crawl. Every operator in this guide is listed in Google’s search help.

The line is what you do next. Three rules keep white-hat dorking on the right side of it.

1. If a page is gated, stop. A login screen, a paywall, or a “confidential” banner means the content was not meant to be public, even if Google indexed it by mistake. Do not open it and do not use it.
2. Automated querying has limits. Google’s Terms of Service restrict scripted access to Search. Pace your queries, keep volumes reasonable, and use a tool that respects rate limits rather than hammering the results page.
3. Personal data carries obligations. A name attached to an email address is personal data under the UK GDPR and comparable laws. Collecting it for B2B outreach can be lawful, but you need a valid basis, you must honour opt-outs, and some jurisdictions are stricter than others. Check the rules that apply to you before you build a list.

These boundaries are the same whether the work is OSINT, security research, or business lead generation, and they line up with the broader question of whether web crawling is legal: the technique is fine, and your conduct with what it returns is what counts. If you are unsure whether a specific use is allowed, that is a question for your own counsel, not something a search guide can answer.

What Google dorks can find, and what this guide leaves out

Google dorks pull information that is already public but hard to reach through a normal search. The kinds of pages they surface, all of it published on purpose by the site owner:

• Contact pages, team pages, and staff directories a company posts on its own site
• Public professional and company profiles
• Price lists, spec sheets, product catalogs, and media kits published to sell or promote
• Government and trade-association directories, membership lists, and public registers
• Public PDFs: reports, whitepapers, tenders, RFPs, brochures
• A site’s own indexed page count, for SEO checks

Those targets are what this guide covers, across lead generation, competitive research, and SEO. Here is what it deliberately leaves alone:

• Login, admin, or password-reset pages
• Configuration files, environment files, logs, database dumps, backups
• Exposed dashboards, cameras, printers, or other connected devices
• Anything behind a paywall, a portal, or a “do not share” notice
• Clearly internal files: payroll, contracts, unredacted customer records

One more line. People do search for “how to Google dork a person” or “dork a phone number.” This guide does not cover tracking a named individual. It is about researching companies and the public professional information a company and its staff chose to post. To reach a specific person, use their employer’s published contact route.

What people use Google dorks for

Dorking serves roughly five kinds of work. This guide covers the last three in depth and treats the first two as background.

Who uses Google dorks, and for what

The operators are the same across all five. Only the target and the intent change.

From search results to a spreadsheet: export your dork results with Octoparse

Whichever of those jobs you are doing, the shape is the same: a dork gives you a page of results, and you need those results as rows in a spreadsheet you can sort, filter, and act on. Doing that by hand is where the manual approach falls apart. Google shows about ten results per page, disabled the num=100 parameter that power users relied on around September 2025, throws a CAPTCHA (the “prove you are human” check) at anything that looks scripted, and hands you nothing you can sort or filter.

Octoparse’s Google Search Scraper template handles that part. It is a ready-made scraper, so there is nothing to build. Three steps:

1. Give it the dork. Paste the whole thing into the All these words field and the operators still work. Or skip the syntax and fill the matching form fields instead, site or domain, file type, none of these words, a date range, and the template assembles the query for you.
2. Set the depth. Pagination times is how many result pages to collect.
3. Run it. The run happens in the cloud, so you can close the tab.
4. What comes back. One row per result, with these fields:

• Title, description, and both the displayed and the destination URL
• Result position and any sitelinks
• Star ratings, when Google shows them
• The AI Overview text and the People Also Ask entries, when they appear on the page

Export it as CSV, Excel, JSON, or straight to Google Sheets. The template is listed at $0.60 per 1,000 rows at the time of writing. The free plan covers 8,000 records a month through the MCP or API connection. Every dork in the sections below is meant to be run this way.

https://www.octoparse.com/template/google-search-scraper

What one run looks like

On 10 September 2026 we ran a single dork through the template to see exactly what comes back:

1. The dork:intitle:"request for proposal" "marketing services" filetype:pdf — an RFP-hunting query from the lead-generation section below.

2. The setup: pasted it into All these words, set Pagination times to 2, hit run.

3. The result: 27 rows in one pass. 19 were live RFP documents, mostly US county, city, and university tenders for marketing and advertising work; the other 8 were Google’s “related searches”. Each real row carried the document title, a snippet with the RFP number and submission deadline, the direct PDF link, and the issuing body’s domain.
4. The cleanup: three PDFs turned up on both result pages, so removing duplicates by URL left 16 unique tenders. Time from pasting the dork to a downloadable CSV: under two minutes.

A quick view of the export

Running dorking as a habit rather than a one-off is common. Google Search is one of the two most-run templates on the Octoparse platform, and heavy users run it more than 100 times per active period. Two ways to keep it going:

• Schedule it. Point the template at a set of standing dorks and have it run weekly, so your prospect or competitor file updates itself.
• Wire it into your own tools. The template is callable, so a script or an AI agent can send a batch of dorks, collect the rows, and drop them into a CRM or warehouse with no browser involved. Our guide on how to pull Google SERP data through an API covers the setup.

A few limits to keep in mind. Dorking only finds pages Google has already indexed, so anything brand new or deliberately kept out of search will not show up. Big sweeps need proxies and cloud runs to stay under rate limits, and those are paid. A result snippet gives you a name and a title, not a verified email, so you still enrich the list before you use it. And every export has some noise in it: dead links, mislabelled results, a directory’s own pages sitting next to real companies. Scan the first screen of rows before you trust the file.

The operators that still work in 2026, and the ones Google dropped

You do not have to memorise the syntax. The Google Search Scraper template turns every operator into a labelled field: all these words, this exact phrase, any of these words, none of these words, site or domain, file type, a number range, plus language, region, and dates. If you do type the operators yourself, here is the set that still works, and the quirks that trip people up.

The operators worth knowing

Most of these work on Bing and DuckDuckGo as well, though not as consistently. site:, filetype:, intitle:, and inurl: are safe on all three; *, before: / after:, and AROUND() are Google-only or patchy elsewhere. If a dork comes back thin on Google, try the same site: and filetype: core on Bing, which sometimes has pages Google missed. Octoparse has Bing and DuckDuckGo templates too, so the same dork can point at any of them.

Operators Google has dropped

Old cheat sheets still list these. They do nothing now, and leaving one in a dork just wastes a term.

Retired operators

One more change matters if you are scraping results rather than reading them: around September 2025 Google switched off the num=100 URL parameter, which used to return 100 results on a page. Every page now stops near ten, so a big result set means many requests. That is a large part of why a tool beats doing it by hand, as the last section covered.

How to build a dork that actually works

A dork is rarely right on the first try. The basic loop is short:

1. Start with site:yourtarget.com, or a plain description of what you want.
2. Add one structure operator, intitle:, inurl:, or filetype:, for the page type you need.
3. Run it and read the first ten results.
4. For each junk result, add a - term or a -site: filter. For each real gap, widen with OR.
5. Repeat three or four times, then save the version that works so you can re-run it.

Here is that loop on one real query, aimed at building a list of independent packaging suppliers in the UK.

Version 1, too broad:

packaging supplier UK

This returns directories, the big distributors, ads, and blog posts about packaging trends. Almost nothing you can act on.

Version 2, add structure:

("packaging supplier" OR "packaging manufacturer") UK (intitle:"contact" OR inurl:contact)

Now you are asking for pages a company labelled as a contact page, in the title or the URL. The results are mostly real suppliers. Two problems show up in the first ten hits: a few large multinationals you do not want, and a run of results from one aggregator that has a contact page per listing.

Version 3, exclude the noise:

("packaging supplier" OR "packaging manufacturer") UK (intitle:"contact" OR inurl:contact) -site:yell.com -site:thomasnet.com -"plc"

The two -site: filters drop the aggregators. -"plc" is a rough way to skip large listed companies. What is left is mostly small and mid-size suppliers with a contact route, and that is a list worth exporting.

The loop is always the same: run it, read the first ten, and each piece of junk points you to the next - term or site: filter. Three or four passes is normal. Save the version that works so you can run it again later.

Google dorks for lead generation

The export routine from earlier applies to every dork here: build the query, run it through the Google Search Scraper template, and each result comes back as a row you can export and work. Two dorks carry most of the value.

Decision-makers on company and association pages

site:targetcompany.com (intitle:"leadership" OR intitle:"our team" OR inurl:team OR inurl:leadership)

Run this once per account you are chasing. A company’s own leadership or team page is public by design, and it gives you names next to the exact job titles that company uses. You would not guess those titles from outside.

For a whole segment at once, go to the trade body:

("board of directors" OR "our members" OR "leadership team") "packaging industry" (site:.org OR site:.asn.au)

Association board and member pages are pre-filtered lists of senior people in one vertical. Swap the industry phrase and the domain suffix for your market.

What you get back from either dork is a page URL, plus names and titles in the snippet. What you do not get is an email address. That is a second step, covered at the end of this section. Our walkthrough on how to scrape contact information for lead generation covers the field mapping once the list is in a sheet. Expect roughly one in five rows to be off-target, usually an old page or the wrong person, so budget cleanup time.

Open RFPs and tenders in your category

(intitle:"request for proposal" OR intitle:RFP OR "invitation to tender") "facilities management" filetype:pdf after:2026-01-01

This is the highest-intent dork in the guide. A published RFP means an active budget, a defined scope, and a named procurement contact on the document itself. filetype:pdf catches the ones posted as documents; drop it and add inurl:procurement to also catch the ones posted as web pages. The after: date keeps stale tenders out.

This is the same style of dork we walked through in the export section above. That run, on "marketing services" RFPs, returned 27 rows in two pages, 16 unique tenders after removing duplicates, each with the PDF link, the issuing body, and the deadline in the snippet, in under two minutes.

Read the first few hits before you scale it. You are checking whether the results are live opportunities or a portal’s archive of closed ones, then adjusting the date and the category words to match. Once it is returning current tenders, a weekly scheduled run turns it into a steady feed of live opportunities.

📈 Case study. A digital marketing agency in Spain scrapes public Google Business Profiles daily to spot newly registered local businesses. Its 30-person remote sales team works the data by signal, for example a business with no website or a weak rating, to personalise outreach. The agency’s benchmark is to make contact within 15 days of a listing appearing, before competitors notice the business exists.

From URLs to contacts, without leaving Octoparse

Both dorks in this section give you URLs, not contacts. Two ways to close that gap, both inside Octoparse.

One template. The Google Search Email Finder (Premium) template runs the same dork, then opens every result page and pulls back emails, phone numbers, and social profiles alongside the search fields. One run, contacts included.

https://www.octoparse.com/template/google-search-email-finder-premium

Two templates, chained. If you want the raw search results and the contacts as separate steps:

1. Run the Google Search Scraper on your dork and export the result URLs.

https://www.octoparse.com/template/google-search-scraper

2. Feed that URL list into Email & Social Media Finder, which visits each page and extracts emails, phones, and social links.

https://www.octoparse.com/template/email-social-media-scraper

Step 1 gives you a plain column of result URLs:

Step 2 turns that list into contacts. In a real run of ten reseller URLs, six came back with an email, a phone number, or a social handle; four sat behind a bot check and returned nothing, which is the normal hit rate:

Either way, the search, the enrichment, and the schedule sit in one place. Most search APIs hand you the raw results and leave the contact step to you.

Google dorks for competitive research

Same routine: run each dork through Octoparse, pull the results into a sheet, and you have a competitor file you can refresh on a schedule instead of rebuilding by hand every quarter.

A competitor’s full price list

site:competitor.com (inurl:pricing OR inurl:price OR intitle:"price list" OR filetype:pdf)

Pricing is often buried on a competitor’s own site but easy to find in Google’s index, because they publish it for their customers and sales team. Run the broad version first, then look at the URL pattern in the results. If pricing lives at /pricing/<product>, tighten to site:competitor.com inurl:pricing and you have the whole set. If it is one PDF that changes each quarter, site:competitor.com filetype:pdf "price" is enough; schedule it to catch the next version.

We ran this against atlassian.com on 10 September 2026, two result pages. It returned 20 rows, and every organic one was an Atlassian pricing page: Jira, Bitbucket, Statuspage, Opsgenie, Compass, Guard, Backup, the cloud licensing calculator. Several snippets carried the plan prices directly, “$0 Free, $7.91 Standard, $14.54 Premium” for Jira, “$399/month Business” for Statuspage. One near-duplicate. That is a competitor’s whole public pricing surface in a single export.

The pricing dork export

The export gives you the pricing-page URLs and whatever price text Google already showed. Pulling the full price tables off those pages is a second step: feed the URL list into a scraper that opens each one. Our overview of how to scrape Google search results covers chaining a search export into a detail scrape like that.

A competitor’s reseller and dealer network

("authorised dealer" OR "authorized reseller" OR "where to buy" OR "find a distributor") "CompetitorBrand" -site:competitor.com

This maps who sells a competitor’s product downstream. The -site:competitor.com matters. Without it, you get the competitor’s own “where to buy” page. With it, you get the resellers’ pages instead, which is what you want. Use it for channel strategy, for finding resellers who might carry your line too, and for seeing how wide a competitor’s distribution really is.

We ran this against "DeWalt" on 10 September 2026, two result pages: 20 rows, 18 unique after removing cross-page repeats. Three were forum and social threads, easy to flag and drop. The rest were the distribution map, authorized dealers, refurbished-tool specialists, industrial distributors, hardware co-ops, marketplace storefronts, and one EU retailer, each on its own domain. Re-run it each quarter and you see new resellers appear and dropped ones fall off.

The reseller dork export

📈 Case study. A European B2B holding company that manages roughly 50 portfolio companies replaced gut-feel pricing with automated weekly competitor price scraping. Its teams now set prices with data-backed formulas, for example the median of three competitors’ prices times a multiplier, rather than anecdotal estimates. Across the portfolio, moving to data-driven pricing has produced a 2% to 4% improvement in profit margins.

Google dorks for SEO research

Dorking also works as a free, rough SEO audit, following the same export-first routine you’ve already learned.

An index health check

site:yoursite.com

The result count is Google’s estimate of how many of your pages it has indexed. It is a rough number, sometimes badly off, so treat it as a signal, not a metric. Say you have about 400 published pages and site: reports 4,000. Something is putting junk in the index, usually tag archives, faceted-navigation URLs, or parameter duplicates. site:yoursite.com inurl:tag or site:yoursite.com inurl:? will show you which. If it reports 40 instead, Google is missing most of your site, and you have a crawling or quality problem.

Link-prospecting footprints

"your topic" ("write for us" OR "guest post" OR "become a contributor" OR intitle:"resources") -site:medium.com -site:quora.com

These are pages that publish outside contributions or curated link lists in your subject area. The exclusions drop open platforms where “guest post” just means anyone posting. The output is just a list of URLs and their snippets, so you work straight from the sheet: export the domains, add a site:<domain> count as a rough authority sort, and prioritise the ones with real contributor guidelines. Those have an editorial process, not a link farm.

We ran the "web scraping" version on 10 September 2026, two result pages: 22 rows, 18 unique. Two were Google “related searches” and a few were forum and platform threads. What was left, about a dozen rows, split into two useful piles: university and library resource pages (.edu, libguides, carpentry) that curate reading lists, and developer blogs with a visible “Write for us” or “Become a Contributor” line in the snippet. Those two piles are your outreach list.

The link-prospecting dork export

Check your own site while you are here

The same site: habit is a quick exposure check on a domain you own or are authorised to test. This is how security teams use site: and filetype: day to day, pointed inward instead of outward, and a small business owner can run the same checks in a couple of minutes.

Run site:yourdomain.com filetype:pdf, then filetype:xlsx, then intitle:"index of". If something turns up that should not be public, deal with it two ways. To keep a page out of Google in the first place, add a noindex tag or put it behind a login. robots.txt is not enough: it asks crawlers not to list a path, but it does not stop anyone opening the file. For a page that is already indexed, use the Removals tool in Google Search Console, then fix the file’s permissions. The Google Hacking Database (linked earlier) is the full catalogue of the patterns security teams run against their own sites.

The cheat sheet (save this)

One compact reference. Every line is discussed above; replace the italic placeholders.

Conclusion

Used this way, Google dorking is not a hacking trick. It is advanced search: a set of filters that turns Google’s index into a research tool for public contacts, competitor data, and directories a plain search would never surface. Keep it white-hat by staying on published information and away from anything gated, use the operators that still work rather than the ones old cheat sheets list, respect the query limits, and handle personal data properly.

What makes it a workflow rather than a novelty is the export. Once the results land in a spreadsheet on a schedule, dorking becomes a standing source for your prospect lists and competitor files. Paste one line from the cheat sheet into the Google Search Scraper template and see what a single run pulls back.

https://www.octoparse.com/template/google-search-scraper

FAQs about Google dorking

1. What are Google dorks used for?

In a business context, three things: building lead lists from public profiles, directories, and tender pages; pulling competitor pricing, catalog, and reseller data; and quick SEO checks like index size and link prospecting. Security teams use the same operators to find their own exposed files, which is where the technique’s reputation comes from.

2. How do I export Google dork results to a spreadsheet?

Run the dork through Octoparse‘s Google Search Scraper template. Paste the query into the All these words field, set how many result pages to collect, and the run returns one row per result: title, both URLs, position, and the AI Overview and People Also Ask blocks when they appear. Export the set as CSV, Excel, JSON, or straight to Google Sheets. It is listed at $0.60 per 1,000 rows, and the free plan covers 8,000 records a month.

3. Can I get contact details from the pages a Google dork finds?

Not from the search results themselves; a snippet gives you a name and a job title, not a verified email. Octoparse’s Google Search Email Finder runs your dork and then visits each result page to pull back emails, phone numbers, and social profiles in the same run. If you already have the result URLs, feed them into the Email & Social Media Finder template instead.

4. Do Google dorks still work in 2026?

The core operators do: site:, filetype:, intitle:, inurl:, intext:, quotes, OR, -, and before: / after:. Several old ones do not: cache:, related:, link:, +, ~, and info: have all been retired. Aggressive automated dorking also hits CAPTCHAs faster than it used to.

5. What are the best Google dorks for OSINT and market research?

For company research, anchor to a domain or directory with site: and add structure filters: site:company.com (inurl:team OR intitle:leadership) for its people, site:company.com filetype:pdf for its documents, site:company.com inurl:pricing for its published prices. This keeps you on information the company posted about itself.

6. Can I automate Google dorking?

Yes. Octoparse’s Google Search Scraper template lets you submit dorks on a schedule and export structured results, and it is API-callable for fully hands-off runs. Keep query volume reasonable and pace requests to stay within Google’s terms.

7. What is the Google Hacking Database (GHDB)?

The Google Hacking Database is a public collection of dork queries, started by researcher Johnny Long and now maintained at Exploit-DB. It catalogues thousands of searches that surface exposed files, devices, and error messages. It is written for penetration testers, so most entries are security reconnaissance rather than business research, but it is the canonical reference for the technique.

8. How can an organisation keep sensitive pages out of Google?

Add a noindex meta tag to pages that should not appear in search, or put them behind a login. robots.txt is not enough on its own: it only asks crawlers not to list a path and does not block access to the file. For pages already indexed, use the Removals tool in Google Search Console, then fix the file’s permissions so it cannot be reached directly.

9. What is the difference between Google dorks and Google search operators?

Search operators are the individual commands, like site: or filetype:. A dork is a complete query built from two or more of them for a specific goal. Every dork is made of operators; a single-operator search is not usually called a dork.