Advanced Online Search and Dorking

This workshop introduces participants to advanced internet search methods, tips and tools, all under the umbrella of a technique known as “dorking.” Participants will learn and practice the technique across different search engines, while applying it to various investigation contexts. The workshop also includes tips on essential digital safety and privacy aspects relevant when searching, collecting and sharing information online.

Learning Activities

Opening (15 minutes)

Instructions

• Grab attention by posing a question or commenting on a relevant topic, image, etc.

• Introduce yourself and the goals of the workshop.

• Optional: introduce the source of the workshop material (Tactical Tech)

• Inform participants of the workshop agenda.

• Suggest ground rules for the workshop: how you expect participants to act and react, respect each other, etc. Depending on the time you spend with the workshop participants, if you are running a longer training you could also consider working on a Shared Agreement or commonly agreed Code of Conduct (see suggestions in the ETI Facilitator's Guide.)

Instructions

• Facilitate a round of introductions by asking participants to answer a couple of questions about themselves, their work, their workshop expectations, etc.

• Alternatively, you can pick an icebreaker exercise that encourages participants to get creative by drawing answers or ideas on an online whiteboard or, if off-line, stand up and perform some tasks. Check the Icebreakers section in the ETI Facilitator's Manual for inspiration.

Introduction to "Dorking" and advanced online search  (25 minutes)

Instructions

[10 minutes] Detailed case study:

• Tell the story of this investigation while pinpointing the different methods that were used: "Locating the Netherlands' Most Wanted Criminal by Scrutinising Instagram", by Bellingcat.

• Provide brief background to the story and why the investigation was needed.

• Focus on the research steps conducted by the investigators.

• Detail the methods used, note the key methods such as use of search operators, reverse image search, crowdsourcing on social media.

• Specify the main tools and how they were used in the context.

• Give some clues but also ask participants to suggest solutions, and sometimes stop to ask participants "how would you do this?" before disclosing the next investigation steps or findings.

[5 minutes] Briefly explain what "(Google) Dorking" is.

• Introduce different examples and cases of advanced search techniques.

• Adapt examples to the context of your audience as much as possible.

Instructions

• Divide participants into small groups and ask them to discuss:

  • "How is dorking relevant to your work?"

• Share the points on a shared (online) whiteboard / flip chart paper.

How Dorking Works (30 minutes)

Instructions

Prepare and give a presentation including:

• Briefly introduce "Search Operators" (also called "dorks"): definition and purpose/use.

  • Use this table for reference and also show other resources (for example: https://neilpatel.com/blog/google-search-operators/; https://moz.com/learn/seo/search-operators).

• Provide a few examples of dorks.

• Emphasize the fact that even if two search engines support the same operators, they often return different results - it is important to know why as this influences the effectiveness of the technique:

  • the same search engine can return different results based on the location where the search is carried from, or

  • two different search engines from the same location, using the same search operators, can return different results because they might use different search algorithms, etc.

Instructions

• Divide participants in small groups of 3-5 members, using online break-out rooms or separate areas/tables in the workshop space (if offline).

• Ask groups to create their own 'Search Operators Cheat Sheet' used with Google, DuckDuckGo, Yahoo and Bing by completing a table of search operators (template available below).

• The table includes a column with the search operators / "dorks" and a column for describing what each operator does.

• Some elements are missing in the table, and participants have to identify the missing parts and complete the table. They will need to use it for a quizz during the next activity.

  • Highlighted parts can be left empty for participants to fill out.

RESOURCE:

• Search Operators Cheat Sheet (Word file - the table can be downloaded and shared online for editing, or printed for in-person workshops)

Instructions

Following up on the previous activity, run a quiz with all the participants.

• Ask a series of questions and by raising hands, representatives of different groups (from the previous activity) can answer based on the cheat sheet they filled out.

• Questions can be in the following formats:

  • What will this "xyz" dork return?
  • What dork to use to return "xyz" information?

Bonus: How Reverse Image Search Works (15 minutes)

NOTE: Reverse image search - a search conducted by image instead of text in a search engine - is used together with advanced text search techniques and connects to "dorking" in that way. As a trainer, you can decide whether to include this section in the workshop as an additional skill, or not.

Instructions

• Introduce what Reverse Image Search is.

• Introduce the different tools available and demonstrate their use with an image of your choice:

  • https://yandex.com/images/

  • https://www.google.com/imghp

  • https://tineye.com/

Instructions

• Divide participants in small groups.

• Show a series of pictures of places, people, items on a shared (online / projected) whiteboard and ask participants to find-out "What / Where / When / Who is that?" through reverse image search.

• If online, upload the images to a public cloud storage and provide the links to participants to download and search.

NOTE: Here are some sample images you can download: 1 / 2 / 3 / 4 / 5. It is recommended to use images that have a context you can easily clarify afterwards.

Let's Dork! (40 minutes)

Instructions

• Divide participants in small groups of 3-5 members.

• Assign a series of missions for the groups to complete within 20-25 minutes.

• The missions can include advanced searches across different search engines to find a list of items such as:

  • a specific image with an exact size,
  • a list of house prices in a certain location,
  • a document related to local public spending in selected areas,
  • a .pdf report on air pollution levels in a certain location,
  • ...

• Check on each group's progress during the activity.

NOTE: You can adapt this list of items based on your participants' context and needs, trying to give tasks that may be relevant to their interests or expectations.

Instructions

• Upon return from their group missions, ask a representative of each team to share their findings with the rest of the groups, answering the following questions:

  • Which search operators did you use? What worked well what didn't?
  • What did you find that was interesting?
  • Did search results differ across search engines? If yes, how?

• Provide feedback and tips as needed.

Safety First! (15 minutes)

Instructions

Prepare and give a short presentation on precautions to take before using dorking as an investigative technique including the following points:

• Be aware of legal issues - dorking can result in retrieving documents that may not be meant for public access.

• Use the Tor Browser when applicable - take care however, since it's difficult to use with some search engines and may be illegal in some countries (trainers need to check where this is the case in their participants' context)

• Use a VPN (Virtual Private Network)

• When at risk, choose privacy-aware search engines such as:

  • DuckDuckGo

  • StartPage

  • Noting that search results will be limited in this case because operators can return different results for each search engine.

RESOURCES:

• "Safety First!" Guide, Exposing the Invisible: The Kit.
• "Search Smarter by Dorking" guide - "to dork or not to dork" section, Exposing the Invisible: The Kit.

Instructions

Prepare and give a short presentation on "Defensive Dorking" including the following points:

• Checking for security vulnerabilities.

• Show the Google Hacking Database (GHDB).

• Looking for sensitive information.

• Dorking yourself (and why that is important/useful).

RESOURCES:

• "Search Smarter by Dorking" guide / "defensive dorking" section, Exposing the Invisible: The Kit.
• "How to Dox Yourself", by Kristen Kozinski and Neena Kapur, the Global Investigative Journalism Network (GIJN)

Closure (15 minutes)

Tools/Materials

• Shared drawing pad / slide / whiteboard (online)
• Whiteboard / flip-chart paper, post-its, markers (offline)

Instructions

• Ask participants to create a takeaway poster by sharing their answers to the following question in the shared whiteboard / drawing board:

  • What are your main takeaways from today's workshop?

• Give participants a few minutes to write and/or draw their thoughts and read the thoughts of others.

Debriefing

• Review and highlight some of the points on the shared board.

Instructions

• Wrap up the workshop and sum up its contents.

• Run a quick review of the session. Each participants would say:

  • one thing they found very good about the session and
  • one thing they would improve for the next time

• You can encourage participants to ask questions or give some final tips.

• Share contact information if relevant, and any follow-up details.

Contact Us

Please reach out to us at Exposing the Invisible if you:

• have any questions about this workshop plan and facilitation guidelines,

• use this workshop plan and want to share feedback and suggestions that can help to improve them,

• adapt the workshop plan to a specific context and want to share the results with us,

• want to suggest new activities, tips or examples that can be added to this workshop,

• want to share your expertise and collaborate with us on developing and testing new workshops.

Contact: eti@tacticaltech.org (GPG Key / fingerprint: BD30 C622 D030 FCF1 38EC C26D DD04 627E 1411 0C02).

Credits and Licensing

CC BY-SA 4.0

This content is produced by Tactical Tech's Exposing the Invisible project, and licensed under a Creative Commons Attribution-ShareAlike 4.0 International license

• Workshop authors: A. Hayder, Laura Ranca, Wael Eskandar

• Instructional design: A. Hayder

• Editorial and content: Christy Lange, Laura Ranca, Wael Eskandar

• Graphic design: Yiorgos Bagakis

• Website development: Laurent Dellere, Saqib Sohail

• Project coordination and supervision: Christy Lange, Laura Ranca, Lieke Ploeger, Marek Tuszynski, Safa Ghnaim, Wael Eskandar

This resource has been developed as part of the Collaborative and Investigative Journalism Initiative (CIJI) co-funded by the European Commission under the Pilot Project: "Supporting investigative journalism and media freedom in the EU" (DG CONNECT).

This text reflects the author’s view and the Commission is not responsible for any use that may be made of the information it contains.