You run a search, a result looks sensitive, and you hesitate. That hesitation is correct. Most guidance answers with a shrug — "it depends" — which helps nobody. The actual dividing line is narrower and more useful than that.
Is Google Dorking Illegal to Do at All?
Typing a search query is not an offence. Search operators are a documented feature of a public search engine, and using them is the same act as any other search.
Nothing is accessed that Google has not already crawled and published. Your query never reaches the target's server. There is no system being entered, no control being defeated, and no data being taken.
That is the easy half, and it is genuinely easy. Almost every difficult question sits in what happens afterwards.
One thing to be clear about before going further: this is context, not legal advice. We are not lawyers, laws differ by country, and facts differ by case.
When Search Reconnaissance Stops Being Just Search
The shift happens when you act on a result rather than read it. That is the distinction worth internalising, because it is the one that consistently matters.
Reading a page a server returns publicly is ordinary browsing. Taking a credential from an exposed file and signing in with it is not — it is authenticated access without permission, and that is what computer misuse law across many jurisdictions is built around.
Between those poles sit the genuinely hard cases. Downloading a database dump that was public. Enumerating paths after one turned up. Retaining a copy after telling the owner. General guidance runs out here, and that is not a failure of the guidance — those cases turn on facts.
Why Authorisation Decides Almost Everything
The same query is routine work or a serious problem depending on whether someone agreed to it. Nothing about the technique changes; the permission does.
Three forms of authorisation come up in practice:
- You own it. Auditing your own infrastructure needs nobody's agreement.
- A contract covers it. Penetration testing engagements define scope, dates and techniques in writing precisely so this question never arises.
- A programme invites it. Bug bounty scope documents are an explicit grant, and an explicit boundary.
What does not count: assuming, a verbal "go ahead" from someone without authority, or a scope you read six months ago. We have watched a scope change mid-engagement and catch someone out — checking it again before each session costs a minute.
If you work bug bounties, scope verification belongs before reconnaissance rather than after. Our guide to staying inside programme scope leads with that ordering for a reason.
What About Data That Was Never Meant to Be Public?
An owner's mistake does not settle your position either way. This is the question we get asked most, and honestly it is the one where general answers help least.
A file being reachable without authentication is a fact about the server. Whether someone intended it is a fact about the owner. The two are separate, and different legal systems weigh them differently.
The pragmatic position most experienced people land on: stop as soon as you understand what you have found, do not download more than needed to confirm it, and tell the owner. Continuing to explore after the picture is clear is what turns a finding into a problem.
Reporting What You Find Without Making It Worse
A short factual message beats a detailed one. Say what you found, where, and how you found it. Do not include the data itself.
Send it to a security contact if one exists — check /.well-known/security.txt before anything else. Failing that, a named person beats a general inbox. Give a reasonable window before going further, and keep your own notes.
Two things to avoid, both of which we have seen backfire. Do not demand payment; that reads very differently to a recipient than you intend. And do not publish before they have had a chance to fix it.
The Uncomplicated Case: Your Own Domain
None of this applies when you are auditing something you control. There is no permission question, no disclosure question, and no ambiguity.
That is the version of this work we would encourage anyone to do routinely. The self-audit queries for your own site exist for exactly that, and each finding comes with its remediation.
If you are earlier than that and want the technique explained first, how dorking works covers what these queries can and cannot reach. Understanding the limits removes a lot of the anxiety.
So — Is Google Dorking Illegal?
The search is not. What you do next can be. Authorisation is the deciding factor, and it needs to exist before you start rather than be argued afterwards.
Point the technique at your own systems and the question never arises. Point it elsewhere and get the permission in writing. Everything difficult sits between those two, and that space is where you want a lawyer rather than a blog post.
To build queries for infrastructure you are cleared to assess, the query builder handles the syntax so your attention stays on scope and results.