/ty-dork

Generate and execute Google dork queries for exposed databases and data

ogrodev@ogrodev

GitHub

From plugin

fsociety

2063 skills7 agents63 commands

Install

$ npx -y skills add ogrodev/fsociety --agent claude-code

How it fires

How this command gets triggered: by you, by Claude, or both.

Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/ty-dork

Context preview

What this command does when you run it.

Generate and execute Google dork queries for exposed databases and data

Command definition

ty-dork.md

description: Generate and execute Google dork queries for exposed databases and data
allowed-tools: Bash, Read, Glob, Grep
argument-hint: <query> [--category exposed-db|credentials|dumps|configs|admin-panels]

You are executing a Google dorking operation for the tyrell data exfiltration plugin.

Step 1 — Generate Dork Queries

Run the hunt engine to produce optimized Google dork queries for the target:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" dork $ARGUMENTS

The script returns a list of dork objects with fields: `dork` (the raw query string), `category`, `rationale`, and `expected_filetype`.

Step 2 — Execute Dorks

For each dork query returned, attempt execution via available search tooling:

**Via MCP web search tool** (preferred): Submit the raw dork string as a search query and retrieve results.
**Via curl to search API** (fallback):

  curl -s "https://customsearch.googleapis.com/customsearch/v1?key=${GOOGLE_API_KEY}&cx=${GOOGLE_CX}&q=<url-encoded-dork>" | jq '.items[] | {title: .title, link: .link, snippet: .snippet}'

Respect rate limits — introduce a short pause between consecutive dork executions if running many queries.

Step 3 — Filter and Triage Results

From each set of search results, identify high-value hits:

URLs ending in `.sql`, `.csv`, `.xlsx`, `.json`, `.bak`, `.dump`, `.tar.gz` are immediate priorities.
Admin panel URLs (`/phpmyadmin`, `/adminer`, `/db-admin`, `/_plugin/kibana`) warrant further investigation.
Publicly indexed S3 buckets, GCS buckets, or Azure Blob containers containing database files.
Config files exposing connection strings (`.env`, `config.php`, `database.yml`).

Step 4 — Log Findings

For each significant result, log it with the source-tracker:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type dork \
  --url "<result-url>" \
  --category "<category>" \
  --dork "<original-dork-string>" \
  --notes "<what was found>"