Dorking means writing a good query string. In Maltego you type the query into a Phrase entity, then run a search transform. Only the dorking transforms parse the operators below; the exact transforms match your phrase literally.
The dorking backends — DarkOwl, Cybersixgill, and WEBIQ — accept query strings, so they share the same operator grammar (below).
The Transforms
All run on a Phrase Entity.
Darkweb — DarkOwl + Cybersixgill (Darkweb hub item)
| Display name | Query type | What it returns |
|---|---|---|
| [Darkweb] Search Posts (dorking) [DarkOwl] | Lucene-style Dorking — Lucene query string | Matches for the query across posts |
| [Darkweb] Search Posts (exact) [DarkOwl] | Exact — phrase matched literally | Exact matches across posts |
| [Darkweb] Find posts related to phrase [Cybersixgill] | Dorking — Lucene query string | Matches for the query across posts |
| [Darkweb] Search for this exact phrase [Cybersixgill] | Exact — phrase matched literally | Exact matches across posts |
Cybersixgill also offers two no-operator preset modes on a Phrase — handy when you don't want to write a dork:
| Display name | What it does |
|---|---|
| [Darkweb] Search for all of these words [Cybersixgill] | Returns posts containing every word in the phrase (implicit AND between words) |
| [Darkweb] Search for any of these words [Cybersixgill] | Returns posts containing at least one word in the phrase (implicit OR between words) |
Telegram — WEBIQ + Gradient (POI hub item)
| Display name | Query type | What it returns |
|---|---|---|
| [POI] Search Historical Posts - dorking (Telegram) [WEBIQ] | Dorking — Elasticsearch query string | Matches for the query across posts |
| [POI] Search Historical Posts - exact (Telegram) [WEBIQ] | Exact — phrase matched literally | Exact matches across posts |
| [POI] Search Historical Posts - exact (Telegram) [Gradient] | Exact — phrase matched literally | Posts with all words from the phrase, in that exact order |
Query grammar (dorking transforms)
| Goal | Syntax | Example |
|---|---|---|
| Phrase, exact order | "..." | "AES 256" |
| Either term | OR (or ||) | drugs OR crime |
| Both terms | AND (or &&) | drugs AND crime |
| Exclude a term | NOT, -, or ! (no space before term) | DarkOwl NOT drugs / -drugs / !drugs |
| Group / subquery | ( ) | DarkOwl AND (hack OR ddos OR 0day) |
| Wildcard — many chars (mid/end only) | * | dar* → dart, darkowl |
| Wildcard — one char (mid/end only) | ? | d?rk → dark, dork |
| Leading wildcard | Not allowed | *owl won't work |
| Proximity (max distance 9) | "..."~N | "password hack"~2 |
| Range — inclusive [ ], exclusive { } | field:[a TO b] | hackishness:[.5 TO 1] |
| Regex (Lucene) | /.../ | /r[0-9a-zA-Z]{24,34}/ |
| Escape a reserved char | \ | darkint\-blog |
Booleans must be UPPERCASE or they're treated as keywords. Reserved characters: + - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ / — escape with \ or wrap the whole term in quotes (e.g. "https://darkowl.com/darkint-blog").
Copy-paste examples (dorking transform)
Company in a breach context:
"Acme Corp" AND (breach OR leak OR dump OR database)Credential-sale chatter, excluding noise:
(combolist OR "fresh logs" OR "cloud accounts") NOT giveawayDomain across posts (anchor the root — no leading wildcard):
acme.com OR "acme corp" OR acmecorp*Ransomware group near a victim (proximity):
"LockBit victim"~5Exact match, no operators — run an exact transform with a plain phrase:
combolistWorkflow in 3 steps
- Drop a Phrase Entity on the graph.
- Type your query — a dork (for a dorking transform) or a plain phrase (for an exact transform).
- Run the Transform for your target: darkweb → [Darkweb] ... [DarkOwl] or [Darkweb] ... [Cybersixgill]; Telegram → [POI] ... [WEBIQ] or [POI] ... [Gradient].
Gotchas
exacttransforms take the phrase literally — the operators above only apply to thedorkingtransforms.- DarkOwl stems keywords (
hackalso matcheshacker,hacking) — use theexacttransform for a literal match. - No leading wildcards (
*term); wildcards work mid/end only. - Quote multi-word phrases or they're treated as
OR-ed separate words. - Proximity max distance is 9; regex can be slow and may time out.
- Gradient exact matches all words in the given order; WEBIQ exact matches the phrase as-is.
References
- Elasticsearch Reference:Lucene query syntax | Elastic Docs