Skip to main content

Google Dorks for Smart Contract Security: Finding Vulnerabilities Before They're Exploited

Google Dorking uses advanced search queries to find hidden or sensitive information exposed on the internet, including vulnerable smart contract code patterns.

Disclaimer: This article is for educational purposes only. Misuse of Google Dorking can be considered hacking in some countries, so please use these techniques responsibly and only on systems you own or have explicit permission to test.

What is Google Dorking?​

Google dorking is the practice of using advanced search queries to find hidden or sensitive information that is exposed on the internet. These queries leverage Google's search operators to filter results more precisely than standard searches.

The Google Hacking Database contains thousands of submitted exploits and search queries that researchers have discovered. These reports can help you learn about common vulnerabilities and how to find them.

Basic Google Dork Examples​

Finding Exposed Private Keys​

One common use case is finding private keys exposed in GitHub repositories:

site:github.com "BEGIN EC PRIVATE KEY" filetype:pem

This dork searches GitHub for files containing EC private keys in PEM format. However, be aware that sometimes people intentionally leave "snake oil" cryptographic keys—intentionally weak or insecure keys used for testing or development. Always verify if you've found a real vulnerability or just a test key.

Using Wildcards​

Wildcards can be powerful for finding partial matches:

site:pastebin.com "ory_*"

This can be used to find pastebin entries with partial words or usernames. This technique can be applied to other code pasting sites as well.

Google Dorking for Smart Contract Vulnerabilities​

Now let's apply Google dorking specifically to smart contract security. We'll look at real-world examples based on actual exploits, such as the Hedgey Finance exploit that resulted in a $2 million loss.

Finding Approval Vulnerabilities​

The Hedgey Finance exploit was caused by a vulnerability where token approvals weren't properly revoked after campaign cancellation. Here are some dorks to find similar vulnerable contracts:

"function createLockedCampaign" "solidity"
"function cancelCampaign" "solidity"
"function transferFrom" "solidity" "require(message.sender equal to owner)"
"approve" "transferFrom" "solidity"
"IERC20" "transferFrom" "approve"

What to look for: These dorks target code where an ERC20 approval is used without proper revocation. They can help find contracts where approvals are given but there's no secure way to revoke them—high-risk contracts similar to the Hedgey issue.

Finding Reentrancy Vulnerabilities​

Reentrancy is another common smart contract vulnerability. Here are dorks to identify potentially vulnerable code:

"function withdraw" "call.value" "solidity"
"msg.sender.call.value" "solidity"
"msg.sender.transfer" "function withdraw"

What to look for: Reentrancy occurs when an external call is made (like call.value or transfer) without properly securing state. These patterns can indicate contracts vulnerable to reentrancy attacks.

Finding Insecure Ownership Checks​

Phishing and scams often exploit insecure ownership checks. Here are dorks to find these patterns:

"require(message.sender equal to owner)"
"tx.origin equal to owner"
"onlyOwner" "tx.origin"

What to look for: Scammers sometimes use tx.origin instead of msg.sender for access control. This makes contracts vulnerable to phishing attacks because tx.origin refers to the original transaction sender, not the immediate caller.

Tools for Testing Google Dorks​

While you can test dorks directly on Google, there are specialized tools that can help:

  • DorkSearch.com: A website specifically designed for testing Google dorks directly. This can be helpful while learning how to write effective dorks.

Best Practices for Security Researchers​

  1. Verify Your Findings: Not everything you find will be a real vulnerability. Always verify before reporting.

  2. Responsible Disclosure: If you find a real vulnerability, follow responsible disclosure practices. Contact the project owners privately before making it public.

  3. Document Your Process: Keep track of the dorks you use and what you find. This helps build your security research skills.

  4. Stay Updated: The Google Hacking Database is constantly updated with new queries. Check it regularly for new techniques.

Common Pitfalls to Avoid​

  1. False Positives: Many results will be false positives—test code, examples, or intentionally weak keys. Always verify.

  2. Legal Considerations: Make sure you have permission to test the systems you're searching for. Unauthorized access is illegal.

  3. Over-Reliance: Google dorking is a tool, not a complete security solution. It should be part of a broader security research methodology.

Conclusion​

Google dorking can be a powerful tool for identifying exposed secrets, code vulnerabilities, and insecure implementations in smart contracts. By combining these search techniques with traditional security auditing methods, you can build a more comprehensive security research practice.

Remember: Use these techniques only for educational purposes or in your own testing environments. Always follow responsible disclosure practices and respect legal boundaries.

The key takeaway is that many vulnerabilities follow patterns, and Google dorking can help you find these patterns across the codebase ecosystem. However, it's just one tool in a security researcher's toolkit—combine it with code audits, formal verification, and other security practices for comprehensive protection.

Read more from Cryptogrammar​