Operators turn a search box into a filter over a crawled index. The cost is that you are querying somebody's index, not the web — coverage, freshness and operator fidelity vary enormously between engines. The mistake beginners make is assuming their query ran as typed. Google routinely drops, stems, and synonym-expands your terms, so a zero-result dork and a silently-rewritten dork look nothing alike but are equally useless.

site:

ip:

contains:

Never run a dork on one engine only. Different crawlers found different pages, and an engine that never crawled a URL cannot be operator-coaxed into it. Which operator survives where, and where the same operator means something different, is in reference/engine-operators.md.

and were retired, was withdrawn long ago and any residual behaviour is noise, and is inconsistent. and were never documented and behave unpredictably. for forced inclusion and for synonym expansion were removed outright, quotes replacing the former, and was superseded by /. A dork library using these returns general results, not an error.

Google's retrieval layer is a semantic matcher with a keyword filter bolted on. It will drop a term it judges unproductive, substitute a synonym, or correct what it thinks is a typo — which is exactly what you do not want when hunting a username or an error string.

Most of what an organisation leaks is hosted by someone else, so sweep the hosts rather than hoping a dork on the target domain catches it: paste and dead-drop hosts, code sandboxes, published-to-web office documents, full-text document repositories, cloud object storage on provider-owned hostnames such as or , and third-party SaaS with public sharing defaults — kanban boards, wikis, form backends, status pages. the provider, not the customer.

Run these against domains you are authorised to assess, or your own estate. Reading a search result is passive — the engine already crawled the page. Fetching the file, downloading the backup, or logging into the panel you found is not, and that is where the legal line sits.

The high-yield shapes, in rough order of hit rate: directory listings left on after a migration (), config and environment files by extension, database dumps and backup artefacts, credential-shaped strings in indexed text, object storage on provider hostnames, and admin or monitoring interfaces exposed by hostname. The full set, with the person- and document-hunting queries, is in reference/dork-cookbook.md.

Engines only index what something linked to, so unlinked panels and bucket listings are badly under-represented — for live services scan with . A hit that now 404s is still evidence: take the URL to .

Detection is not primarily about request rate. Engines fingerprint the client: TLS handshake characteristics, header ordering, whether JavaScript executed, timing behaviour, and the reputation of the source IP. A datacentre IP that has never rendered JavaScript trips the check on its first request, while a residential IP driving a real browser at human pace can dork all day. That is why slowing your loop down often fails when hand-typing the same query works.

The nastiest failure is not the CAPTCHA but a degraded result set that looks normal: operators silently ignored, results truncated, no indication. Never assume a scripted query returned what the browser would.

Sanctioned routes, in preference order. Official search APIs where an engine sells one: within terms, but expect quotas and no parity with the consumer UI, because the API's index and ranking are frequently a different product. Commercial SERP providers, which run the proxy infrastructure and return structured results — paid, and still scraping under someone's terms. Your own SearXNG instance, which normalises results across engines; never a public one, where you inherit strangers' rate-limit reputation and hand your selectors to its operator. And by hand in a browser, which for the twenty to fifty queries a real investigation needs beats building the automation.

Rotating IPs to evade detection is circumvention of a technical access control — a materially different legal posture from scraping, and out of bounds here. The query itself is also logged and attributable, so route sensitive selectors through a non-logging engine or an isolated environment, per .

Each of these ingests a different corpus and answers a question Google cannot.

Cite URL, engine, query string and retrieval date. A result nobody can re-run is not evidence.

Objective: identify who handles procurement at Example Corp, for a supplier due-diligence file. The website lists no names below board level.

in Verbatim returns four documents. One is a supplier onboarding pack whose PDF properties carry an author string, , and a template path under a departmental network share — two new selectors out of a document that names nobody in its body.

The dead end: returns nothing, and neither does the bare handle. No profile, or not in the index.

Rewriting to the email shape works. hits a public mailing-list archive on an unrelated domain, where the same person signed a technical question with a full name and job title. A Bing sweep of the target host then surfaces a supplier register corroborating the role.

Grade: role confirmed, on two documents both retrieved and read. Identity probable — the handle-to-name mapping rests on one self-signed post.

Automated querying breaches the terms of every major engine. That is a contract matter and the usual consequence is a block — but defeating those blocks by rotating IPs or solving CAPTCHAs programmatically is circumvention of a technical access control, a more serious question in several jurisdictions.

Finding an exposed file confers no authorization to retrieve it. The result is public; the file behind it may still be a protected computer under computer-misuse law, and "it was in Google" has failed as a defence. Inside an authorized assessment, document it, do not exfiltrate it, report through the agreed channel. Outside one, notify the operator or a national CERT and stop.

Indexed personal data is still personal data — search does not launder it. De-indexing requests also make material deliberately absent from European result sets while present elsewhere, so compare regions before concluding anything is gone. Minimise per ../../ETHICS.md.