How to Make Private Google Dorks for SQLi – 500+ SQL Injection Dorks 2026

[Blacksec]

SQLI DORKS – FIND INJECTABLE SITES BEFORE ANYONE ELSE
​

SQL injection is the oldest trick in the hacking book and it still works, because people still make the same mistakes. But the hardest part isn't running the injection. It's finding the sites. That's where SQLi dorks come in. A SQLi dork is a Google search that finds websites with database-driven pages, the ones with ?id=phpasp and other dynamic patterns. Those are the sites you can test for SQL injection. This guide shows you how to build private dorks that find targets nobody else is scanning, plus 500+ ready-made combinations to get you started.
What is SQL injection? Simple version
SQL is the language websites use to talk to their databases. When a site builds a query without checking what you type, you can make it do things it shouldn't, dump passwords, leak customer data, even take over the server. You type something sneaky into the search box or the URL, and the database does what you say instead of what the site intended. The formula is always the same: a dynamic page + poor input validation = injection.
The core dork patterns
Every SQLi target has a dynamic URL. These are the skeleton patterns:

inurl:index.php?id= inurl:product.php?id= inurl:item.php?id= inurl:news.php?id= inurl:page.php?id= inurl:view.php?id= inurl:article.php?id= inurl:detail.php?id= inurl:content.php?id= inurl:main.php?id= inurl:cat.php?id= inurl:prod.php?id= inurl:shop.php?id= inurl:read.php?id= inurl:show.php?id= inurl:info.php?id= inurl:mod.php?id= inurl:gal.php?id= inurl:download.php?id= inurl:search.php?q= inurl:category.php?id= inurl:subcat.php?id= inurl:pid= inurl:page= inurl:prd= inurl:product= inurl:item= inurl:view= inurl:news= inurl:article= inurl:detail= inurl:cat= inurl:content= inurl:redir= inurl:go= inurl:link= inurl:load= inurl:click= inurl:submit= inurl:search=

ASP and other extensions
Not everything is PHP. These find the Microsoft stack:

inurl:.asp?id= inurl:.aspx?id= inurl:.cfm?id= inurl:.jsp?id= inurl:.php?id= inurl:.cgi?id= inurl:.shtml?id= inurl:.pl?id= inurl:.php3?id= inurl:.php4?id= inurl:.php5?id= inurl:.do?id= inurl:.action?id= inurl:default.asp?id= inurl:index.asp?id= inurl:news.asp?id= inurl:view.asp?id= inurl:article.asp?id=

CMS-based dorks
Every platform has known injectable patterns. WordPress:

inurl:wp-content/plugins/ inurl:wp-admin/admin-ajax.php inurl:wp-json/wp/v2/ inurl:"?p=" intitle:wordpress inurl:"?page_id=" -inurl:wp-login inurl:wp-login.php intext:"username"

Joomla, Drupal and the rest:

inurl:index.php?option=com_ inurl:index.php?option=com_content inurl:index.php?option=com_contact inurl:index.php?option=com_news inurl:index.php?option=com_search inurl:index.php?option=com_user inurl:index.php?view=article inurl:/node/ inurl:/node/1 inurl:/drupal inurl:/joomla inurl:/magento inurl:/prestashop inurl:/opencart inurl:/xenforo

Combining operators for private dorks
The 500+ list is the start, not the finish. To make dorks that others don't have, combine operators:

inurl:.php?id= intext:"© 2023" -intext:"© 2026" inurl:.asp?id= -inurl:login -inurl:admin inurl:product.php?id= intext:"out of stock" inurl:news.php?id= site:gov.* inurl:item.php?id= site:edu.* inurl:.php?id= intext:"powered by" -intext:"wordpress" inurl:.asp?id= intext:"shopping cart" inurl:category.php?id= intext:"USD" inurl:.php?id= inurl:/shop/ inurl:.php?id= intext:"contact" inurl:.php?id= ext:php inurl:.asp?id= ext:asp

The country trick works great too, target smaller TLDs where sites are older and less patched:

inurl:.php?id= site:.pk inurl:.php?id= site:.in inurl:.php?id= site:.bd inurl:.asp?id= site:.ng inurl:.php?id= site:.id inurl:.php?id= site:.np inurl:.php?id= site:.lk

How to test what you find

1. Open the candidate URL and add a quote mark to the id value: site.com/item.php?id=5'
2. Error or weird behavior? The site is echoing your input, potential injection point.
3. Mark the working URLs and run them through sqlmap for the real check.
4. sqlmap basics: sqlmap -u "site.com/item.php?id=5" --batch --dbs
5. Only ever test on sites you're allowed to test. Seriously.

Why private dorks win
Public SQLi dork lists get burned in a week. Everyone uses them, Google starts showing the same 100 old results, and the good stuff hides. When you build your own combinations, your own platforms, your own countries, your own operator stacks, you see targets the masses miss. Ten minutes of creative combining beats any old pastebin list.
SQLi dork FAQ

• 
  Are these dorks legal to use?
  Searching is fine. Testing without permission is not, use them on your own lab sites or authorized targets.
• 
  How often should I build new dorks?
  Weekly. Sites get patched, indexes change. Fresh dorks = fresh targets.
• 
  Dorks or scanners?
  Dorks find the candidates, then tools like sqlmap and Masscan do the heavy lifting. Both, in order.
• 
  Why does Google return nothing?
  Slow down, automated searches get filtered. Space out your queries and vary the phrasing.

That's the full SQLi dork game: learn the patterns, build your own, test responsibly. The 500+ combos above are your ammunition, the private dorks you build from them are your edge. BlackSec, where the hunters share their dorks.