Internet Search
Investigation Techniques4.1 Google Dorks – 20 essentials
| Objective | Dork | Example |
|---|---|---|
| Government PDFs | site:gov filetype:pdf "contract" |
Mexico |
| Exposure | intitle:"index of" passwords.txt |
— |
| IP Cameras | inurl:viewer/live/index.html |
— |
| Emails | site:linkedin.com "@company.com" |
— |
| Subdomains | site:*.target.com -www |
— |
4.2 Alternative Search Engines
- DuckDuckGo "bangs" →
!archive - Yandex → best results CIS
- Baidu → Asia
- Startpage → no logs
- Shodan → IoT, ICS, SCADA
- Censys → cert + banner
- FOFA → China, free API
- BinaryEdge → global scanning
- Hunter.io → corporate emails
- PublicWWW → search in source code
- SearchCode → search in 75B lines of code
- SimilarSites → similar sites
- Netlas → internet intelligence
- CriminalIP → search in connected internet
- NerdyData → website technologies
- GreyNoise → internet noise
- Intezer Analyze → malware analysis
- Kaspersky OpenTIP → threat scanning
- VirusTotal → file/URL analysis
- AlienVault OTX → threat exchange
- ExploitDB → exploit database
- MalwareBazaar → malware samples
- Malware Domain List → malicious domains
- PhishTank → phishing URLs
- URLhaus → malware URLs
- ThreatMiner → threat intelligence
- YARAify → YARA rules
- PulseDive → IOC search
- ThreatFox → malware IOCs
- Breach Directory → breach searches
- Have I Been Pwned → breach verification
- DNSViz → DNSSEC visualization
- DNSdumpster → DNS enumeration
- SpyOnWeb → related sites
- Yark → archive YouTube
- CovertAction → investigative journalism
- Trellix Research → threat research
- CP Research → Checkpoint research
- Wikistrat → collaborative analysis
- PolySwarm → threat scanning
- HackerOne Hacktivity → public vulnerabilities
- WikiLeaks → leaked documents
- Talos Reports → vulnerability reports
- MalAPI → malware APIs
- UserSearch → user search
- SecureList → Kaspersky blog
- SPLC Hate Map → hate map
- ICSR → radicalization studies
- Militant Wire → militancy analysis
- START Publications → terrorism publications
- SPLC Resources → SPLC resources
- Tracking Terrorism → terrorism tracking
- Mapping Militants → mapping militants
- Naval Institute → naval news
- Institute of International Relations → international relations
- Janes → defense intelligence
- TASS News → Russian news
- Sputnik News → Sputnik news
- PIPS → Pakistan peace studies
- PICSS → Pakistan conflict studies
- Reuters → news agency
- RT → Russia Today
- InternetActivism → humanitarian tools
- IISS → international studies institute
- CFR → council on foreign relations
- SciHub → access to scientific papers
- ResearchHub → research discussion
- IDCrawl → people search
- Osint Industries → email/phone search
- ESPY → phone search
- SUNDERS → surveillance cameras
- Deepinfo → internet intelligence
- Session → private messaging
- Consortium News → independent journalism
- Tutanota → encrypted email
- Committee to Protect Journalists → journalist protection
- SecurityWeek → security news
- NCRI → network contagion research
- Geopolitical Economy Report → geopolitical reports
- The Grayzone → independent journalism
- FlightAware → flight tracking
- FlightRadar24 → flight radar
- MarineTraffic → maritime traffic
- VesselFinder → ship search
- NewspaperArchive → newspaper archives
- The Indian Express → Indian news
- Daily Excelsior → Jammu Kashmir news
- DNA India → Indian news
- Greater Kashmir → Kashmir news
- Nagaland Post → Nagaland news
- RFE/RL → Radio Free Europe
- Akto → API security
- Generated Photos → AI photos
- HDRobots → AI tools directory
- Channel 4 News → British news
- ThreatMon Reports → threat reports
- Israel Datasets → Israeli datasets
- AI Dubbing → AI dubbing
- Budget Key → Israel budget
- Ship Spotting → ship photos
- Broadcastify → police audio
- OpenCelliD → cell tower database
- AviationStack → aviation API
- DocumentCloud → document management
- IDRW → Indian defense
- XFE → X-Force exchange
- Scumware → malware research
- Ukraine Live Cams → Ukraine cameras
- TWN → webcam network
- Opentopia → public webcams
- Transparency → anti-corruption
- Maigret → user search
- OCCRP → organized crime
- Qdorks → dork generator
- Radio Garden → world radios
- LolArchiver OSINT → OSINT search
- BreachBase → breach base
- WorldCam → world webcams
- Webcam Galore → webcams
- WiFi Map → WiFi hotspots
- OpenTrafficCamMap → traffic cameras
- Skyline Webcams → skyline webcams
- Pictimo → world webcams
- Instances.social → Mastodon recommender
- CamHacker → public webcams
- Labs TIB Geoestimation → geographic estimation
- Picarta → photo location prediction
- Tiny Scan → URL scanning
- ZeroDay → zero-day vulnerabilities
- Predicta Search → digital search
- Ventusky → weather maps
- OSV → open source vulnerabilities
- Coalition ESS → exploit scoring
- Validin → attack surface mapping
- CIRCL PDNS → passive DNS
- InTheWild → exploits in wild
- 360 Quake → cyberspace mapping
- Cloudflare Radar → internet trends
- Crisis24 → security risk management
- arXiv → scientific papers
4.3 Archives and snapshots
- Wayback Machine
- CachedView (Google + Archive.is)
- URLScan → capture + DOM + requests
- Ubikron → AI-powered evidence collection & entity extraction
- Screenshot Guru → screen test
- Stored Website → cached pages
- ThreatMiner → IOC context
- YARAify → YARA rules
- PulseDive → IOC search
- ThreatFox → malware IOCs
- Breach Directory → breaches
- Have I Been Pwned → breach verification
- DNSViz → DNSSEC
- DNSdumpster → DNS enumeration
- SpyOnWeb → related sites
- Yark → archive YouTube