skills.rest
UseOSINT
UseOSINTOFFICIAL
Explore all skills by this author →
GitHub

google-like-a-spy

Craft advanced search-engine queries and Google dorks to surface hidden files and mentions.

38|2|Updated Aug 2, 2026
Search Tags:#investigation#reconnaissance#osint#search engines#search operators#data exposure#google dorks
One-click install
npx skills add https://github.com/UseOSINT/Skills --skill google-like-a-spy-useosint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: google-like-a-spy
Source: https://github.com/UseOSINT/Skills/tree/main/skills/google-like-a-spy
Command: npx skills add https://github.com/UseOSINT/Skills --skill google-like-a-spy-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Standard search queries miss most of what an investigation needs: leaked documents, exposed configuration files, and mentions of a selector scattered across paste sites and third-party hosts. This Skill teaches how to build precise search-engine queries that actually run as typed, across Google, Bing, Yandex, DuckDuckGo, and independent crawlers. ## Core Features & Use Cases - Operator mastery: Covers site:, filetype:, inurl:, intitle:, intext:, before:/after:, verbatim mode, and which operators still work versus which silently degrade into plain search terms. - Cross-engine strategy: Explains operator differences between Google, Bing, Yandex, DuckDuckGo, and independent crawlers, including Bing's ip: and ext: and Yandex's rhost: and mime:. - Dork cookbook: Ready-to-adapt query sets for finding an organization's documents, a person's accounts, exposed directories and config files, leaked selectors on paste hosts, and open cloud buckets. - Use Case: During supplier due diligence, run site:example.com filetype:pdf procurement in Verbatim mode, extract an author handle from PDF metadata, then pivot to "m.okafor@example.com" to find a mailing-list post revealing the person's full name and role. ## Quick Start Ask the agent to build a Google dork that finds PDF documents mentioning a target company hosted outside its own domain.

Frequently Asked Questions about google-like-a-spy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a Google dork to find exposed files?▼

Combine site: with filetype: or ext: and intitle:"index of" to locate directory listings, config files, and backups, for example site:example.com ext:env. Run every query in Verbatim mode so Google does not rewrite or drop your terms.

Which search engine is best for site: enumeration?▼

Bing honors site: more literally and enumerates hosts more completely than Google, which truncates and deduplicates aggressively. Yandex offers rhost: for matching a domain plus subdomains, and independent crawlers like Mojeek surface pages the majors dropped.

Why does my Google dork return zero or irrelevant results?▼

Google stems terms, substitutes synonyms, spell-corrects, and drops terms it judges unproductive, so the query that ran differs from what you typed. Enable Verbatim mode, quote tokens individually, and check the "Missing:" notice in the results header.

Do filetype: and ext: operators work the same way?▼

No. Google's filetype: matches the content type determined during indexing, while Bing's ext: matches the URL extension. For hunting .env, .bak, or .sql files, ext: on Bing is more reliable because those files often have no registered content type.

Is it legal to use Google dorks to find exposed files?▼

Reading search results is passive because the engine already crawled the page, but fetching or using an exposed file may violate computer-misuse law. Run discovery dorks only against estates you own or are authorized to assess, and report findings through the agreed channel.

Can I automate Google dorking with scripts?▼

Automated querying breaches every major engine's terms and triggers fingerprint-based blocking that can silently degrade results. Sanctioned options are official search APIs, commercial SERP providers, a self-hosted SearXNG instance, or manual browser queries.

Related Skills

Explore More Education & Research Skills→
refly-airefly-ai
199

hunter

Find and verify professional email addresses using Hunter.io for company domains.

Official
Intermediate
uphiagouphiago
1.1k

vhost-enumeration

Fuzz Host headers and parse SSL certificate SANs to discover hidden virtual hosts.

Community
Intermediate
nowork-studionowork-studio
3.4k

sitemap-audit

Audit XML sitemaps to detect invalid URLs, crawl budget waste, and indexing gaps.

Official
Intermediate
gadievrongadievron
3.5k

github-wayback-recovery

Recover deleted GitHub content from Wayback Machine and CDX API archives.

Community
Intermediate