[![Docker Build & Test](https://github.com/techgaun/github-dorks/actions/workflows/docker-build.yml/badge.svg)](https://github.com/techgaun/github-dorks/actions/workflows/docker-build.yml)

# GitHub Dorks

[Github Search](https://github.com/search) is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is supposed to be useful for assessing security and performing pen-testing of systems.

## GitHub Dork Search Tool

`github-dorks` is a Python command-line tool that searches a repository or an
organization/user's repositories using the queries in a dorks file.

### Installation

This tool uses [github3.py](https://github.com/sigmavirus24/github3.py) to talk with GitHub Search API.

Clone this repository and run:

```shell
pip install .
```

### Docker Installation

You can also run github-dorks using Docker for a consistent environment:

```shell
# Build the Docker image
docker build -t github-dorks .

# Run with a GitHub token (recommended)
docker run -e GH_TOKEN=your_github_token github-dorks -u someuser

# Run with username/password
docker run -e GH_USER=your_username -e GH_PWD=your_password github-dorks -u someuser

# Save results to a CSV file
docker run -v $(pwd)/output:/app/output -e GH_TOKEN=your_github_token github-dorks -u someuser -o /app/output/results.csv
```

### Usage

```
GH_USER  - Environment variable to specify Github user
GH_PWD   - Environment variable to specify a password
GH_TOKEN - Environment variable to specify Github token
GH_URL   - Environment variable to specify GitHub Enterprise base URL
```

Some example usages are listed below:

```shell
github-dorks -r techgaun/github-dorks                          # search a single repo

github-dorks -u techgaun                                       # search all repos of a user

github-dorks -u dev-nepal                                      # search all repos of an organization

GH_USER=techgaun GH_PWD=<mypass> github-dorks -u dev-nepal     # search as authenticated user

GH_TOKEN=<github_token> github-dorks -u dev-nepal              # search using auth token

GH_URL=https://github.example.com github-dorks -u dev-nepal    # search a GitHub Enterprise instance

github-dorks -r techgaun/github-dorks --max-retries 5         # retry recoverable failures up to five times

github-dorks -r techgaun/github-dorks --format json           # stream JSON to stdout

github-dorks -u dev-nepal --format jsonl -o results.jsonl     # write newline-delimited JSON

github-dorks -u dev-nepal --format csv -o results.csv --force # explicitly replace an existing file

github-dorks --list-categories                                # list bundled dictionaries

github-dorks -r techgaun/github-dorks -c cloud -c devops      # scan selected categories

github-dorks --local ./cloned-repo -c ai -c identity          # scan a local working tree

github-dorks --local . --format jsonl -o local-results.jsonl  # save offline results
```

The legacy `python github-dork.py ...` invocation remains available for
compatibility. The package can also run as `python -m github_dorks ...`.

Each scan ends with a summary of queries, matches, failures, retries, and
elapsed time. The command exits with status `0` after a complete scan, `2` when
one or more queries failed, and `1` for fatal configuration, file, or
authentication errors.

Local scans do not require GitHub credentials or network access. In a Git
working tree, the scanner checks tracked files and non-ignored untracked files;
elsewhere it recursively checks files while excluding `.git`. It supports the
dictionary syntax used by this project, including quoted text, `OR`, `NOT`, and
the `filename:`, `path:`, `extension:`, and common `language:` qualifiers.
Binary files and files larger than 1 MB are skipped by default. Override that
limit in bytes with `--max-file-size`.

Supported result formats are `text`, `csv`, `json`, and `jsonl`. Text is the
default for terminal output; using `-o/--output` without `--format` preserves
the historical CSV default. Existing files are protected unless `--force` is
provided. Use `--quiet` to suppress progress and summaries, or `--verbose` to
print every query as it runs. Structured stdout remains machine-readable because
status messages are sent to stderr.

The bundled dictionary is split into `ai`, `cloud`, `databases`, `devops`,
`frameworks`, `identity`, `observability`, `private-keys`, `saas`, and `system`
categories. Repeat `-c/--category` to combine categories. With no category or
custom `--dork` file, the command uses the backward-compatible
`github-dorks.txt` aggregate. That aggregate is generated from the category
files with `python scripts/build-dorks.py`.

### Development

Run the dependency-free unit test suite with:

```shell
python -m unittest discover -s tests -v
```

The CI test matrix covers Python 3.10 through 3.13.

### Limitations

- Authenticated requests receive higher rate limits. Searches may pause until
  GitHub resets the search limit.
- Large category combinations can take time because GitHub applies a separate
  search rate limit.
- Offline scanning inspects the current working tree only; Git history scanning
  is not yet supported.

### Contribution

Please consider contributing dorks that can reveal potentially sensitive information on GitHub.
Documented sources for newer credential families are maintained in
[docs/dork-sources.md](docs/dork-sources.md).

### List of Dorks

The canonical dictionaries are the [categorized files](github_dorks/dorks).
The generated [github-dorks.txt](github-dorks.txt) file contains every category
for backward compatibility.
The table below provides descriptions for many established patterns; newer
credential families and their vendor references are tracked in
[docs/dork-sources.md](docs/dork-sources.md). Many dorks can be modified to make
the search more specific or generic. You can see more options
[here](https://docs.github.com/en/search-github/github-code-search/understanding-github-code-search-syntax).

 Dork                                           | Description
------------------------------------------------|--------------------------------------------------------------------------
filename:.npmrc _auth                           | npm registry authentication data
filename:.dockercfg auth                        | docker registry authentication data
extension:pem private                           | private keys
extension:ppk private                           | puttygen private keys
filename:id_rsa or filename:id_dsa              | private ssh keys
extension:sql mysql dump                        | mysql dump
extension:sql mysql dump password               | mysql dump look for password; you can try varieties
filename:credentials aws_access_key_id          | might return false negatives with dummy values
filename:.s3cfg                                 | might return false negatives with dummy values
filename:wp-config.php                          | wordpress config files
filename:.htpasswd                              | htpasswd files
filename:.env DB_USERNAME NOT homestead         | laravel .env (CI, various ruby based frameworks too)
filename:.env MAIL_HOST=smtp.gmail.com          | gmail smtp configuration (try different smtp services too)
filename:.git-credentials                       | git credentials store, add NOT username for more valid results
PT_TOKEN language:bash                          | pivotaltracker tokens
filename:.bashrc password                       | search for passwords, etc. in .bashrc (try with .bash_profile too)
filename:.bashrc mailchimp                      | variation of above (try more variations)
filename:.bash_profile aws                      | aws access and secret keys
rds.amazonaws.com password                      | Amazon RDS possible credentials
extension:json api.forecast.io                  | try variations, find api keys/secrets
extension:json mongolab.com                     | mongolab credentials in json configs
extension:yaml mongolab.com                     | mongolab credentials in yaml configs (try with yml)
jsforce extension:js conn.login                 | possible salesforce credentials in nodejs projects
SF_USERNAME salesforce                          | possible salesforce credentials
filename:.tugboat NOT _tugboat                  | Digital Ocean tugboat config
HEROKU_API_KEY language:shell                   | Heroku api keys
HEROKU_API_KEY language:json                    | Heroku api keys in json files
filename:.netrc password                        | netrc that possibly holds sensitive credentials
filename:_netrc password                        | netrc that possibly holds sensitive credentials
filename:hub oauth_token                        | hub config that stores github tokens
filename:robomongo.json                         | mongodb credentials file used by robomongo
filename:filezilla.xml Pass                     | filezilla config file with possible user/pass to ftp
filename:recentservers.xml Pass                 | filezilla config file with possible user/pass to ftp
filename:config.json auths                      | docker registry authentication data
filename:idea14.key                             | IntelliJ Idea 14 key, try variations for other versions
filename:config irc_pass                        | possible IRC config
filename:connections.xml                        | possible db connections configuration, try variations to be specific
filename:express.conf path:.openshift           | openshift config, only email and server thou
filename:.pgpass                                | PostgreSQL file which can contain passwords
filename:proftpdpasswd                          | Usernames and passwords of proftpd created by cpanel
filename:ventrilo_srv.ini                       | Ventrilo configuration
[WFClient] Password= extension:ica              | WinFrame-Client infos needed by users to connect toCitrix Application Servers
filename:server.cfg rcon password               | Counter Strike RCON Passwords
JEKYLL_GITHUB_TOKEN                             | Github tokens used for jekyll
filename:.bash_history                          | Bash history file
filename:.cshrc                                 | RC file for csh shell
filename:.history                               | history file (often used by many tools)
filename:.sh_history                            | korn shell history
filename:sshd_config                            | OpenSSH server config
filename:dhcpd.conf                             | DHCP service config
filename:prod.exs NOT prod.secret.exs           | Phoenix prod configuration file
filename:prod.secret.exs                        | Phoenix prod secret
filename:configuration.php JConfig password     | Joomla configuration file
filename:config.php dbpasswd                    | PHP application database password (e.g., phpBB forum software)
path:sites databases password                   | Drupal website database credentials
shodan_api_key language:python                  | Shodan API keys (try other languages too)
filename:shadow path:etc                        | Contains encrypted passwords and account information of new unix systems
filename:passwd path:etc                        | Contains user account information including encrypted passwords of traditional unix systems
extension:avastlic "support.avast.com"          | Contains license keys for Avast! Antivirus
filename:dbeaver-data-sources.xml               | DBeaver config containing MySQL Credentials
filename:.esmtprc password                      | esmtp configuration
extension:json googleusercontent client_secret  | OAuth credentials for accessing Google APIs
HOMEBREW_GITHUB_API_TOKEN language:shell        | Github token usually set by homebrew users
xoxp OR xoxb                                    | Slack bot and private tokens
.mlab.com password                              | MLAB Hosted MongoDB Credentials
filename:logins.json                            | Firefox saved password collection (key3.db usually in same repo)
filename:CCCam.cfg                              | CCCam Server config file
msg nickserv identify filename:config           | Possible IRC login passwords
filename:settings.py SECRET_KEY                 | Django secret keys (usually allows for session hijacking, RCE, etc)
filename:secrets.yml password                   | Usernames/passwords, Rails applications
filename:master.key path:config                 | Rails master key (used for decrypting `credentials.yml.enc` for Rails 5.2+)
filename:deployment-config.json                 | Created by sftp-deployment for Atom, contains server details and credentials
filename:.ftpconfig                             | Created by remote-ssh for Atom, contains SFTP/SSH server details and credentials
filename:.remote-sync.json                      | Created by remote-sync for Atom, contains FTP and/or SCP/SFTP/SSH server details and credentials
filename:sftp.json path:.vscode                 | Created by vscode-sftp for VSCode, contains SFTP/SSH server details and credentails
filename:sftp-config.json                       | Created by SFTP for Sublime Text, contains FTP/FTPS or SFTP/SSH server details and credentials
filename:WebServers.xml                         | Created by Jetbrains IDEs, contains webserver credentials with encoded passwords ([not encrypted!](https://intellij-support.jetbrains.com/hc/en-us/community/posts/207074025/comments/207034775))
"api_hash" "api_id"                             | Telegram API token
"https://hooks.slack.com/services/"             | Slack services URL often have secret API token as a suffix
filename:github-recovery-codes.txt              | GitHub recovery key
filename:gitlab-recovery-codes.txt              | GitLab recovery key
filename:discord_backup_codes.txt               | Discord recovery key
extension:yaml cloud.redislabs.com              | Redis credentials provided by Redis Labs found in a YAML file
extension:json cloud.redislabs.com              | Redis credentials provided by Redis Labs found in a JSON file