sitedorks automates query construction across Google, Bing, Brave, Ecosia, Yahoo and Yandex for authorized OSINT and bug bounty reconnaissance, turning categorized site lists into browser-ready dorks.
| Tool | Zarcolio/sitedorks — Python tool that queries multiple search engines with a search term across hundreds of dorkable websites |
| Category | OSINT / search engine reconnaissance |
| Primary Use | Automating site: dork generation across categorized website lists during authorized pentests, bug bounty recon and OSINT investigations |
| Safe Use | Educational and documentary analysis for authorized professionals: use only in sanctioned engagements, bug bounty programs with defined scope, labs, and defensive exposure assessments of your own assets |
| Telemetry Note | Generates ordinary search engine queries from the operator's own browser; search providers see normal-looking dork traffic and may respond with CAPTCHAs. Defenders monitor public search indexing of their exposed content |
sitedorks is a Python 3 utility written by Zarcolio that takes a single search term and fans it out across major search engines — google, baidu, bing, brave, bing-ecosia, duckduckgo, yahoo and yandex — paired with a curated list of websites commonly searched via dorks. Rather than typing dozens of site: queries by hand, the operator supplies a term like '"uber.com"' and the tool opens browser tabs for each engine query, batched across the sites in its input file. With roughly 1059 stars on GitHub and a GPL-3.0 license, it sits squarely in the recon phase of authorized engagements, bug bounty workflows and OSINT investigations.
The core asset of the project is its default CSV, csv/WorldWide.csv, which the README says currently covers 638 dorkable websites including ChatGPT, Github, Gitlab, Surveymonkey, Trello, Moltbook and Grok. Every entry is assigned to a category, and the category counts are published in the README: ai (7), analysis (13), cloud (105), comm (83), ddns (3), dev (69), docs (80), edu (13), events (15), fin (18), forms (1), orgs (61), other (7), shortener (41), social (100) and storage (9). This taxonomy is what elevates sitedorks from a URL generator to a structured recon aid: you can interrogate only collaboration platforms, only code hosting, or only paste-like storage services, depending on what kind of leak you are hunting in your own scope.
Architecturally the tool is deliberately thin. The README states it should run on a default Kali Linux installation with Python 3 without any additional pip packages, which tells you the entire engine is URL templating per search provider plus CSV parsing — no headless browser, no API keys, no scraping of results. Installation is the standard pattern: git clone https://github.com/Zarcolio/sitedorks followed by bash install.sh, which presumably drops the script on your path. That dependency-free design means the output surface is entirely what the engines themselves return; the tool simply constructs the queries and opens them in your browser of choice via the -browser flag.
The CLI is where the operational nuance lives. Beyond -query (the mandatory search term), the important switches are -cat for selecting one or more categories with comma delimiters, -cats to list categories on file, -file for a custom website list, -filter to restrict queries to sites containing a string, and -excl to exclude domains from the query. The -site flag controls whether the site: operator is used at all, set to off, or replaced with inurl: — the latter only working on Google. A -count option splits dorks into multiple queries with fewer sites each, because as the README notes, some engines silently truncate or ignore overly long queries.
Two of those flags deserve particular attention from a tradecraft standpoint. -echo prints the constructed search query URLs instead of opening them, which makes the tool pipeable, bookmarkable and scriptable — useful when you want to archive queries as evidence in an authorized assessment report rather than blasting tabs. -wait sets the delay between queries, defaulting to 7 seconds, and the README explicitly warns that running without -cat will open a flood of tabs and likely trigger a Google CAPTCHA. That warning is honest engineering: the rate limiting is left to the operator, and responsible pacing matters both for staying usable and for not abusing the engines.
The README also highlights regional customization, which is a differentiator from generic dork list repositories. Country-specific CSVs ship for China, France, Germany, Korea, Netherlands and Russia, containing generic sites for those locales, and there is a maintained list of Dutch governmental agencies and educational services that lets you search those domains with a single command. The author flags both areas as Help wanted, inviting contributions of more country lists and more entries — a signal that the project treats its data files as living community assets rather than a frozen snapshot.
Custom input files are where the tool earns its keep in a pentest context. The README suggests putting dozens of client-owned domains into one file so a single invocation covers an entire engagement scope, and the example sitedorks -cat medi -file sitedorks-nl.csv -query somekeyword shows the pattern: category filtering plus a custom CSV plus a keyword. Because a custom file can be either a categorized CSV or a plain list of sites, the format is forgiving. Help embedded in the CSVs themselves is surfaced through -hh (--help2), which prints leading # comment lines from the file being used — a small but thoughtful documentation mechanism.
From a defensive perspective, sitedorks is essentially a mirror of what attackers and bug hunters do continuously: enumerate what search engines have indexed about an organization. Blue teams can use the identical tooling and CSVs against their own domains to find exposed Trello boards, Github gists, Surveymonkey forms, docs leaks or misconfigured cloud buckets that public crawlers have already swallowed. The categories cloud, comm and docs are the usual suspects for accidental disclosure, and running this against your own registered assets before someone else does is exactly the kind of continuous exposure checking the tool enables.
The engine list is also broader than most dork tools bother with. Including yandex, baidu, brave and bing-ecosia (with the README noting Ecosia is Bing-based and, charmingly, that using it plants trees) acknowledges that index coverage differs per provider — content dropped from Google's index may still surface on Yandex. For an authorized investigator tracing a leaked document or an exposed credential paste, multi-engine coverage materially increases recall compared to Google-only tooling.
Points to watch: the tool has no proxy, header or account handling, so engines will treat your traffic as ordinary browser queries, and aggressive use without -wait tuning will hit CAPTCHAs quickly. The star-count badges and visit counters in the README are cosmetic; the substantive quality signal is the regularly updated site list and the maintained country CSVs. For practitioners who want raw dork inspiration, the README points to external resources like the #googledorks hashtag and public dork lists, positioning sitedorks as the execution layer over that shared knowledge base.
Overall, Zarcolio/sitedorks is a modest, focused tool that solves a real ergonomics problem: dorking across hundreds of sites and seven engines by hand is tedious and error-prone. Its value is the maintained categorized dataset plus the query-splitting and echoing mechanics, and its zero-dependency footprint makes it trivial to deploy in a lab or engagement VM. Used within authorized scope — your own domains, contracted engagements, or programs like HackerOne, Bugcrowd and Intigriti hinted at by the repo topics — it is a solid first-pass exposure enumerator before deeper automated recon.
Zarcolio/sitedorks.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.