Quick answer: Google dorking and Shodan are passive reconnaissance tools for finding information exposed about an organization on the internet without directly contacting the target. Google dorking uses advanced search operators (site:, filetype:, inurl:) to find sensitive files and pages indexed by search engines. Shodan is a search engine that scans internet connected devices and services (open ports, cameras, databases, industrial systems). Both are the first and quietest step of a penetration test.

Why does passive reconnaissance matter?

An attack or an authorized penetration test begins by gathering information from public sources before directly contacting the target. This is called passive reconnaissance and leaves no trace. Google dorking and Shodan are the two most powerful tools of this phase because they surface information the organization unknowingly exposed to the internet without disturbing the organization at all.

The key point is this: these tools show the organization's own exposed information. So they are equally valuable for defense; they let you see your own exposed surface before an attacker does.

Google dorking operators

Operator Function
site: Limiting to a specific domain
filetype: Searching a specific file type (pdf, xls, sql)
inurl: Searching a specific word in the URL
intitle: Searching in the page title
cache: The old version in the search engine's cache

When these operators are combined, they can surface sensitive documents accidentally indexed by search engines (backups, configuration files, login panels, leaked lists). Organizations are often unaware that these files are indexed by search engines.

What can Shodan find?

Shodan scans not websites but internet connected devices and services. It shows open ports, service banners, versions and often systems exposed to the outside that the organization is unaware of (admin panels, databases, cameras, industrial control devices). By searching its own IP range on Shodan, an organization can see everything it left exposed to the internet through the attacker's eyes.

Defense: how to reduce exposed information?

  1. Prevent sensitive files and directories from being indexed by search engines (robots, access control).
  2. Detect and remove indexed sensitive content and get it dropped from the search engine.
  3. Expose only genuinely necessary services to the internet, close the rest with a firewall.
  4. Regularly monitor your own IP range with Shodan and similar tools.
  5. Manage the exposed attack surface with continuous discovery and inventory (ASM).

The KAOS and DSET approach

In the passive reconnaissance phase of penetration tests DSET surfaces the organization's exposed information on the internet: indexed sensitive files, exposed services and leaked data. Our KAOS security engine gathers the external attack surface from passive sources. In our field experience the most common situation is a backup file the organization did not know was indexed by search engines or a forgotten admin panel visible on Shodan. Our goal is to show the organization's exposed surface before an attacker does.

Related reading: OSINT and passive information gathering, external attack surface OSINT, subdomain discovery and enumeration, attack surface management ASM, directory and content discovery gobuster ffuf, leaked API keys and secrets management.

Frequently asked questions

Is Google dorking legal? Using advanced search operators, that is, searching the public pages the search engine already indexed, is legal in itself. What is illegal is gaining unauthorized access with a flaw or sensitive information found. Organizations can freely use Google dorking for defensive purposes to see their own exposed information.

Does Shodan search websites? No, Shodan scans not web pages but internet connected devices and services: open ports, service banners, versions, cameras, databases and industrial systems. By searching its own IP range on Shodan, an organization can see all the services it left exposed to the internet through the attacker's eyes and close the unnecessary ones.

How do you defend against passive reconnaissance? Because passive reconnaissance gathers public information, the defense is not exposing that information in the first place: preventing sensitive files from being indexed, exposing only necessary services to the internet, and regularly monitoring the exposed surface. Regularly scanning your own organization with Google dorking and Shodan is the most effective way to see your exposed surface before an attacker does.

Sources

To discover your organization's exposed information on the internet, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.