> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/online-courses/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/online-courses/api-penetration-testing-course/api-reconnaissance/passive-reconnaissance/google-dorking.md).

# Google Dorking

Even without any Dorking techniques, finding an API as an end-user could be as easy as a quick search.

<figure><img src="https://825333096-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrbHTUw6JmYWHWgF1IhRj%2Fuploads%2FNbGMsAeRFJW1VkWscIoc%2F3QiE3ZaXRLWKOYwRfCre_redditapisearch.png?alt=media&amp;token=4392faff-83ac-423c-ab5b-1c6984dea905" alt=""><figcaption><p><em>Google Search for Reddit's API</em></p></figcaption></figure>

However, sometimes you may not get the exact results you were hoping for. If you are getting too many irrelevant results then you could deploy some Google Dorking techniques to more effectively discover APIs.

| Google Dorking Query                                         | Expected results                                                                                                                                   |
| ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| **inurl:**"/wp-json/wp/v2/users"                             | Finds all publicly available WordPress API user directories.                                                                                       |
| **intitle:**"index.of" intext:"api.txt"                      | Finds publicly available API key files.                                                                                                            |
| **inurl:**"/api/v1" intext:"index of /"                      | Finds potentially interesting API directories.                                                                                                     |
| **ext:**&#x70;hp inurl:"api.php?action="                     | Finds all sites with a XenAPI SQL injection vulnerability. (This query was posted in 2016; four years later, there are currently 141,000 results.) |
| **intitle:**"index of" api\_key OR "api key" OR apiKey -pool | This is one of my favorite queries. It lists potentially exposed API keys.                                                                         |