An advanced Google dorking tool designed specifically for bug bounty hunters and security researchers. Generate comprehensive, intelligent dorks across multiple search engines with a single command.
- 20+ Vulnerability Categories: Comprehensive coverage including sensitive files, database exposure, API keys, admin panels, and more
- 170+ Advanced Dorks: Carefully crafted dorks that go beyond basic searches
- Multi-Engine Support: Google, Bing, DuckDuckGo, Yahoo, and Yandex
- Multiple Export Formats: TXT, JSON, CSV, and beautiful HTML reports
- Bug Bounty Focused: Categories specifically designed for vulnerability discovery
- Subdomain Discovery: Advanced patterns for finding hidden subdomains
- Cloud Storage Detection: Find exposed S3 buckets, Azure blobs, and GCS storage
git clone <your-repo-url>
cd Mind_Dork
chmod +x mind_dork.pyNo external dependencies required - uses Python standard library only!
# Generate dorks for a target (outputs to organized folder)
python3 mind_dork.py -t example.com
# Generate dorks for specific search engine
python3 mind_dork.py -t example.com -e bing
# Generate dorks with HTML output
python3 mind_dork.py -t example.com -f html
# Generate dorks for all search engines (all in one folder)
python3 mind_dork.py -t example.com --all-enginesAll outputs are automatically organized in folders:
results/
└── example_com_20231020_143022/
├── google_report.html
├── bing_report.html
├── duckduckgo_report.html
├── yahoo_report.html
└── yandex_report.html
Folder naming: results/target_TIMESTAMP/
You can also specify a custom output directory:
python3 mind_dork.py -t example.com -d my_custom_folder# Generate dorks for specific categories
python3 mind_dork.py -t example.com -c sensitive_files database_exposure api_keys_tokens
# Export to JSON with custom filename
python3 mind_dork.py -t example.com -f json -o my_dorks.json
# Export to CSV for spreadsheet analysis
python3 mind_dork.py -t example.com -f csv
# List all available categories
python3 mind_dork.py --list-categories
# List all supported search engines
python3 mind_dork.py --list-enginesFind exposed sensitive documents, configuration files, and credentials
- CSV/PDF/Excel/Word documents with sensitive keywords
- SQL/Database files with passwords
- Log files with credentials
- Environment files with API keys
Detect exposed databases and database management interfaces
- phpMyAdmin panels
- Adminer interfaces
- Database dumps and backups
- SQL files with CREATE/INSERT statements
Locate configuration files containing credentials
- .env files
- wp-config.php
- config.ini/config.yml
- Connection strings
Find exposed password files and credential dumps
- Password lists
- User databases
- Credential CSV files
- Login information
Discover administrative interfaces and login portals
- /admin, /administrator paths
- WordPress admin panels
- cPanel/WHM interfaces
- Jenkins dashboards
Find open directory listings exposing internal files
- Index of / pages
- Backup directories
- Upload directories
- Configuration directories
Locate exposed API keys and access tokens
- AWS credentials
- Stripe API keys
- Google API keys
- OAuth tokens
- Private keys
Find exposed cloud storage buckets
- AWS S3 buckets
- Azure Blob storage
- Google Cloud Storage
- DigitalOcean Spaces
Enumerate subdomains and hidden services
- Wildcard subdomain searches
- API/Dev/Test/Staging environments
- Internal services
Find error messages revealing sensitive information
- SQL errors
- PHP errors
- Stack traces
- Database connection errors
Identify software versions and potential vulnerabilities
- Server version information
- phpinfo() pages
- README/CHANGELOG files
- Build information
Detect exposed Git repositories and source code
- .git directories
- .gitignore files
- Git configuration files
- Repository objects
Find Jenkins instances and CI/CD pipelines
- Jenkins dashboards
- Build jobs
- Credentials pages
- API endpoints
WordPress-specific security issues
- wp-config.php backups
- Debug logs
- Plugin directories
- Upload directories
Atlassian product exposure
- Jira projects
- Confluence spaces
- REST API endpoints
- Admin panels
Container and orchestration exposure
- Docker Registry
- Kubernetes dashboards
- docker-compose files
- Container APIs
Database service exposure
- Elasticsearch clusters
- MongoDB instances
- Kibana dashboards
- Database indices
Find exposed email addresses and contact information
- Email lists in CSV/Excel
- Email addresses in documents
- Contact databases
- Mail archives
Exposed source code and development files
- PHP/ASP/JSP files with credentials
- Backup code files
- Development directories
- Language-specific files with secrets
Locate backup files and archives
- .zip, .tar.gz, .rar backups
- .sql.gz database backups
- .bak files
- Old/temporary files
Find exposed server and application logs
- Access logs
- Error logs
- Debug logs
- Application logs with credentials
Discover SSL certificates and private keys
- .pem, .crt, .key files
- Private key files
- Certificate stores
- Keystore files
Clean, readable text format with organized categories and clickable URLs
Structured data perfect for automation and integration with other tools
{
"target": "example.com",
"search_engine": "google",
"categories": {
"sensitive_files": {
"description": "Exposed sensitive files and documents",
"dorks": [...],
"count": 10
}
}
}Spreadsheet-friendly format for filtering and analysis
Beautiful, interactive HTML report with:
- Responsive design
- One-click search buttons
- Copy-to-clipboard functionality
- Category organization
- Statistics dashboard
Most comprehensive operator support, best for complex queries
Alternative results, supports unique operators like ip: and feed:
Privacy-focused, limited operators but different result sets
Similar to Google, can find missed results
Russian search engine with unique mime: operator
- Run dorks on all search engines - Different engines index different content
- Check results regularly - New content gets indexed constantly
- Combine with other tools - Use with subdomain enumeration and port scanning
- Focus on high-value categories - Start with credentials, API keys, and database exposure
- Respect scope - Only test on authorized targets
- Report responsibly - Follow responsible disclosure practices
python3 mind_dork.py -t hackerone.com -f htmlpython3 mind_dork.py -t example.com -c credentials_passwords api_keys_tokens sensitive_files -f jsonpython3 mind_dork.py -t target.com --all-engines -f htmlpython3 mind_dork.py -t example.com -f json -o dorks.json
# Parse JSON with jq or custom scripts
cat dorks.json | jq '.categories.sensitive_files.dorks[].query'This tool is designed for authorized security testing only. Users are responsible for:
- Obtaining proper authorization before testing
- Complying with all applicable laws and regulations
- Following responsible disclosure practices
- Respecting bug bounty program rules and scope
Unauthorized access to computer systems is illegal. Use this tool responsibly and ethically.
Contributions are welcome! Feel free to:
- Add new dork patterns
- Suggest new categories
- Report bugs
- Improve documentation
MIT License - Feel free to use, modify, and distribute
Created for the bug bounty and security research community
Stay safe and hack responsibly!