ApiDorkRun

API discovery and manual request workbench

Search / dork runner

Authorized use onlyUse only assets you own or have permission to assess. This tool builds search URLs; it does not retrieve secrets or bypass access controls.

Queries (one per line; # comments ignored)

Import query list (.txt, max 2 MB)

Optional target domain

Launch delay (seconds, 0–60)

Maximum queries (0 = all)

Allow browser launches Open in new tabs Dry run

Ready. Prepare queries to preview URLs.

0Queries

0URLs prepared

0Launch attempts

Prepared search URLs

Browser popup blockers may prevent multiple tabs from opening.

No URLs prepared yet.

Query template packs

Choose a category to replace the editor, or append all templates.

Manual API request workbench

Authorized API testing onlyImport a local OpenAPI JSON file or enter one endpoint. Browser CORS/network rules may block requests. No credentials or history are stored by this app.

Import OpenAPI 3.x / Swagger 2.0 JSON (max 2 MB)

JSON only; YAML is not supported.

Imported endpoint (optional)

HTTP method

Request URL

Headers (JSON object)

Request body (ignored for GET / HEAD)

Import a spec or enter a URL.

—HTTP status

—Duration

0 BResponse size

Readable response headers

Response body (display limited to 1 MB)

Manual requests only; no fuzzing or automatic endpoint scanning. Credentials are omitted by default. Use test environments for non-read-only methods. CORS failures do not prove that an endpoint is down.

Bookmarklet

Copies a query prompt for a desktop bookmark.

javascript:(function(){var q=prompt('Search query:','inurl:api filetype:json');if(q)window.open('https://www.google.com/search?q='+encodeURIComponent(q),'_blank','noopener');})();

Notes

Static app: no backend, telemetry, or server-side secret storage. Search results depend on the provider. Browser CORS, TLS, and network restrictions apply to API requests.