/ty-dork

description: Generate and execute Google dork queries for exposed databases and data
allowed-tools: Bash, Read, Glob, Grep
argument-hint: <query> [--category exposed-db|credentials|dumps|configs|admin-panels]

You are executing a Google dorking operation for the tyrell data exfiltration plugin.

Step 1 — Generate Dork Queries

Run the hunt engine to produce optimized Google dork queries for the target:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" dork $ARGUMENTS

The script returns a list of dork objects with fields: `dork` (the raw query string), `category`, `rationale`, and `expected_filetype`.

Step 2 — Execute Dorks

For each dork query returned, attempt execution via available search tooling:

• **Via MCP web search tool** (preferred): Submit the raw dork string as a search query and retrieve results.
• **Via curl to search API** (fallback):

  curl -s "https://customsearch.googleapis.com/customsearch/v1?key=${GOOGLE_API_KEY}&cx=${GOOGLE_CX}&q=<url-encoded-dork>" | jq '.items[] | {title: .title, link: .link, snippet: .snippet}'

Respect rate limits — introduce a short pause between consecutive dork executions if running many queries.

Step 3 — Filter and Triage Results

From each set of search results, identify high-value hits:

• URLs ending in `.sql`, `.csv`, `.xlsx`, `.json`, `.bak`, `.dump`, `.tar.gz` are immediate priorities.
• Admin panel URLs (`/phpmyadmin`, `/adminer`, `/db-admin`, `/_plugin/kibana`) warrant further investigation.
• Publicly indexed S3 buckets, GCS buckets, or Azure Blob containers containing database files.
• Config files exposing connection strings (`.env`, `config.php`, `database.yml`).

Step 4 — Log Findings

For each significant result, log it with the source-tracker:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type dork \
  --url "<result-url>" \
  --category "<category>" \
  --dork "<original-dork-string>" \
  --notes "<what was found>"

Step 5 — Present Results

Output a structured report grouped by category:

Exposed Databases

• List URLs with brief description

Credentials / Config Files

• List URLs with brief description

Data Dumps

• List URLs with file types and estimated relevance

Admin Panels

• List URLs accessible without auth

Include the assigned source IDs for follow-up with `/ty-classify` or `/ty-acquire`.