How to Find Cardable Sites with Google Dorks (2026) – 50+ Working Dorks

[Blacksec]

GOOGLE DORKS – THE SECRET SEARCHES THAT FIND CARDABLE SITES
​

The best cardable sites are never posted anywhere. They're found, with Google dorks. A dork is just a smart search command. Google has hidden operators that filter results in powerful ways, and when you combine them right, you can find small shops with weak checkout systems that no one else has touched yet. This is how the pros keep finding fresh cardable sites while everyone else fights over the same old list.
What makes a dork find a cardable site?
Cardable sites are usually small stores running common platforms without extra security. Dorks look for the signs: the platform name, the checkout URL pattern, the lack of 3DS hints. When you search for the platform + the weak pattern, you get a pile of candidates.
The dork operators you need to know
Before the dorks, learn the building blocks:

• 
  site:
  - search inside one domain (site:amazon.com)
• 
  inurl:
  - keyword must be in the URL (inurl:checkout)
• 
  intitle:
  - keyword in the page title
• 
  intext:
  - keyword in the page body
• 
  inurl:"=" or inurl:"?"
  - dynamic pages, often where injection happens
• 
  ext:
  - file type (extdf, ext:sql)
• 
  -keyword
  - exclude results (checkout -paypal)
• 
  "exact phrase"
  - match the exact phrase

50+ carding dorks that actually return results
Platform-based, the fastest way to find candidate shops:

inurl:cart.php inurl:viewcart.php inurl:"index.php?route=checkout" inurl:"index.php?route=product" inurl:shop/checkout inurl:store/checkout inurl:com/checkout inurl:eshop inurl:products/checkout inurl:"wp-content/plugins/woocommerce" intitle:"checkout" inurl:cart inurl:"basket" inurl:"order.php" inurl:"purchase.php" inurl:"buy.php" inurl:"payment.php" inurl:"pay.php" inurl:"confirm.php" inurl:"process_order" inurl:"place_order" inurl:"add-to-cart" inurl:"?add-to-cart="

Platform signatures:

intext:"Powered by WooCommerce" inurl:checkout intext:"Powered by Shopify" inurl:cart intext:"Powered by PrestaShop" inurl:checkout intext:"Powered by Magento" inurl:checkout intext:"Powered by OpenCart" inurl:checkout intext:"Powered by osCommerce" intext:"Powered by Zen Cart" intext:"Powered by BigCommerce" intext:"Powered by Wix" inurl:checkout intext:"Powered by Squarespace" inurl:checkout

Weak-security markers:

inurl:checkout intext:"cash on delivery" inurl:checkout intext:"bank transfer" -paypal inurl:cart intext:"pay on delivery" inurl:checkout intext:"no credit card required" inurl:checkout intext:"authorize.net" -3d intext:"SSL secured" inurl:checkout -"verified by visa" inurl:checkout intext:"3D Secure" -"verified by visa" -"mastercard securecode" intext:"verified by visa" -"securecode" inurl:cart.php -inurl:login

Digital goods, instant delivery, often the least protected:

inurl:digital inurl:checkout inurl:download inurl:checkout inurl:"product" inurl:"download" inurl:"checkout" intext:"instant delivery" inurl:checkout intext:"instant download" inurl:checkout intext:"gift card" inurl:checkout intext:"e-voucher" inurl:checkout intext:"email delivery" inurl:checkout inurl:redeem inurl:checkout

Small shop hunting, businesses with cheap websites:

inurl:shop inurl:checkout intext:"contact us" inurl:store inurl:checkout -amazon -ebay -walmart inurl:cart inurl:checkout intext:"free shipping" inurl:checkout intext:"© 2024" -"© 2026" inurl:checkout intext:"© 2025" -"© 2026" intext:"powered by" inurl:checkout -"3D secure" -"verified"

How to turn dorks into cardable sites

1. Run the dorks and collect the results, aim for 20-50 candidate URLs.
2. Open each site and check the checkout flow. Add a test item, go to checkout, see what happens.
3. Green flags: no OTP page, no verification popup, country selector, COD option.
4. Test with a small amount using a fresh BIN from the non VBV list.
5. Keep the winners in the cardable sites list and share them.

Why private dorks beat public dorks
Public dorks get burned. Everyone uses them, everyone hammers the same sites, sites patch, and Google starts filtering the results. Private dorks are your own combinations, unique operators, niche platforms, small country TLDs. Ten minutes of combining operators in your own way gives you results nobody else is seeing.
Dork FAQ

• 
  Are dorks illegal?
  Searching is not a crime. What you do with the results is your responsibility.
• 
  Google blocked my search?
  That's usually too many automated searches. Slow down, use different keyword combos, rotate search engines.
• 
  Why do my results look like junk?
  Dork results always have noise. The skill is reading titles and URLs fast and knowing which links are worth opening.
• 
  Dorks or checkers?
  Both. Dorks find candidates, checkers test them at scale. Dorks are free and keep working when checkers fail.

The dork game is a skill that never expires. Platforms change, but the weak checkout patterns stay the same, and Google keeps indexing them. Learn these, make your own, and you'll never run out of fresh cardable sites. BlackSec, the only forum where you learn the whole chain, from dork to drop.