File Phish

Tool Description : A query builder that allows you to discover exposed documents, sensitive files, and hidden data across the web in seconds.

File Phish	Quick Overview
URL	https://greylensresearch.github.io/filephish/
What it does	Rapidly discovers documents online using keyword combinations, file-type filters, and site-specific search operators.
How to use it	Input keywords, select file types and search engine, and view results.
Cost	Free.
Account required	No.
Cookies	Minimal (standard browser behaviour only).
Ownership	Developed by GreyLens. Ownership not publicly disclosed.
Use in Reporting	Useful for demonstrating publicly exposed documents, data leakage, or weak document security practices.

What does File Phish do?

File Phish is all about precision discovery. Instead of manually crafting advanced search operators, it does the heavy lifting for you.

It lets you quickly build targeted queries that surface:

• Exposed PDFs, spreadsheets, and internal docs.

• Forgotten uploads on public servers.

• Sensitive files indexed by search engines.

It supports multiple engines like Google, Bing, Baidu, and DuckDuckGo, giving you broader coverage and different indexing angles for deeper OSINT work.

The lowdown: It enables fast, structured searching that supports investigations without direct access to target systems.

How to Use:

1. Enter a keyword into the search bar then select file types e.g. PDF files, Spreadsheets, Presentations etc. Then select a search engine e.g. Google or Baidu, and generate the query.

In our example, we searched for OSINT across PDF files and Google:

2. The query then takes you direct to the search engine as below:

3. Run across multiple search engines, compare results, and analyse findings.

Cost

• Free

• Partially Free

• Paid

Data Processing

Account Required:

• Yes

• No

Cookies:

Minimal. When visiting the site on 30.04.26, no cookies were logged for our session.

Use in Reporting

File Phish is ideal for:

• Demonstrating data exposure via indexed documents.

• Supporting OSINT investigations into organisations or individuals.

• Highlighting poor document handling or access control.

• Showing how easily sensitive files can be discovered with basic techniques.

In real-world terms, File Phish is commonly used to uncover publicly exposed documents, map organisations through leaked files, and gather intelligence for phishing, threat analysis, or due diligence.

Capabilities	Limitations
Rapid generation of advanced search queries.	Relies on search engine indexing so won’t find unindexed files.
Supports multiple search engines (Google, Bing, Baidu, DuckDuckGo etc.)	Results depend on keyword selection.
Filters by file type (PDF, DOC, XLS etc).	Some search engines may limit or personalise results.
Enables targeted document discovery at scale.	No direct analysis. Discovery only.

Summary

FilePhish sits in the collection phase of the OSINT workflow, helping analysts find already-exposed documents and sensitive files across the web using advanced search queries.

Ownership

File Phish is owned by GreyLens which appears to operate as a small, independent OSINT-focused project/group, not a widely registered or transparent company with named directors.

Ethical Considerations

• Only access publicly available data.

• Avoid downloading or distributing sensitive material unnecessarily.

• Respect privacy and legal boundaries.

• Use findings responsibly in authorised investigations or research.

Related Tools:

• theHarvester

• SpiderFoot

• Maltego

Sources

https://greylensresearch.github.io/filephish/

https://www.greylens.com/

https://www.linkedin.com/company/greylens/about/

https://github.com/greylensresearch