CEH Footprinting, Reconnaissance and Scanning Practice Question
Which of the following Google dorks would an attacker MOST likely use to find login pages of web applications that are publicly accessible?
⚠ Common exam trap
EC-Council often tests the distinction between operators that find specific page content (like 'intitle:') versus those that find file types or cached data, leading candidates to confuse 'inurl:robots.txt' (which finds a specific file) with finding login pages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
intitle:login
The Google dork 'intitle:login' is most effective for finding login pages because it searches for the word 'login' in the HTML title tag of web pages. Attackers use this to quickly identify publicly accessible authentication portals, which are common entry points for brute-force or credential-stuffing attacks. This dork directly targets the page title, a standard HTML element that often contains the word 'login' on authentication pages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
intitle:login
Why this is correct
The `intitle:login` Google dork is a highly effective reconnaissance tool for attackers, specifically designed to locate web pages where the HTML `<title>` tag contains the word "login". This operator is crucial for identifying potential authentication interfaces, administrative panels, or other sensitive entry points on target systems. By focusing the search on page titles, it efficiently filters out irrelevant results, allowing attackers to quickly pinpoint web pages that likely require user credentials. This precision makes it an invaluable technique for initial information gathering and identifying potential attack vectors.
- ✗
inurl:robots.txt
Why it's wrong here
The `inurl:robots.txt` Google dork is utilized to discover `robots.txt` files, which are standard files websites use to guide web crawlers on which parts of a site should or should not be indexed. While these files can sometimes inadvertently reveal directory structures or sensitive paths that an attacker might later exploit, this specific dork does not directly search for or identify login pages. Its primary function is to locate and examine the directives intended for search engine bots, not to find authentication portals.
- ✗
filetype:pdf
Why it's wrong here
The `filetype:pdf` Google dork is employed to restrict search results exclusively to Portable Document Format (PDF) files. Attackers often use `filetype` dorks to uncover sensitive documents, such as internal reports, employee directories, or configuration manuals, that might have been inadvertently exposed. However, this dork is entirely unsuitable for locating login pages, as it filters results based on file extension and does not target the content or structure of web-based authentication interfaces, which are typically HTML documents.
- ✗
cache:example.com
Why it's wrong here
The `cache:example.com` Google dork is not a search operator for finding specific content across the web; instead, it instructs Google to display the last cached version of a specified URL, such as `example.com`. This functionality is useful for viewing a page as it appeared at a previous point in time or accessing content that might currently be offline. However, it does not perform a search for login pages or any other content; it merely retrieves a stored snapshot of a single, known web address, making it irrelevant for discovering new login portals.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.