Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started
← All tools

Dork Builder

Recon & Discovery

A 68-dork recon arsenal across Google/Bing/DuckDuckGo, GitHub and Shodan - pre-built for sensitive data, secrets and attack surface.

What is Dork Builder?

Dork Builder turns a domain (or org/keyword) into 68+ ready advanced search queries that surface exposed files, login portals, sensitive directories, leaked credentials, vulnerable parameters and a target’s attack surface - no operator memorising required.

It spans three engine families: web search (Google, with the same dorks one-click-openable in Bing & DuckDuckGo), GitHub code search (API keys, .env, private keys, DB strings, kubeconfig…) and Shodan (host/cert/org recon and exposed RDP/DB/login services). Dorks are grouped into categories - recon, files, secrets, login, params, errors, API, cloud and third-party leaks - so you can filter to exactly what you need.

Each dork has copy & one-click-open buttons (plus copy-all), and queries auto-fill with your target. The Shodan favicon dork plugs in the hash from the Tech Fingerprint tool to find every host serving the same app.

What it builds

  • Web dorks (35) - subdomains, exposed config/backups, directory listings, .git, docs, params, errors, phpinfo.
  • GitHub dorks (21) - keys/secrets (AWS, Google, Stripe, Slack, JWT), .env, id_rsa, configs, DB strings, kubeconfig.
  • Shodan dorks (12) - by hostname / SSL cert / org / favicon hash, plus exposed RDP, databases and login portals.
  • Category filter - narrow to recon, files, secrets, login, params, cloud or leaks.
  • Cloud & leak hunting - S3/GCS/Azure buckets, Pastebin, Trello, code playgrounds.
  • Copy / open / copy-all - fire any dork straight into the chosen engine.

Where it fits in your workflow

  • →Hunt for exposed config files, backups and credentials tied to a target.
  • →Find login portals, admin interfaces and forgotten subdomains fast.
  • →Pivot to GitHub/Shodan to catch secrets and exposed services the web index misses.
Use Dork Builder

Sign in to access this tool.

Create free account Sign in

At a glance

CategoryRecon & Discovery
RunsIn your browser
Token cost Free - no tokens
Access Free
Status● Live

Frequently asked questions

Is dorking legal?

Searching public indexes is legal; accessing or using exposed data you find still requires authorization. Stay within your engagement scope.

Do the dorks work in Bing and DuckDuckGo?

Mostly - the core operators (site:, inurl:, intitle:, ext:/filetype:) are supported, but Bing and DuckDuckGo implement a subset of Google’s syntax, so very complex dorks may need trimming.

Explore more tools →