GitHub Recon
MITRE ATT&CK™ Data from Information Repositories - Technique T1213
Theory
Online repositories of code hold a window into an organization's technology stack, revealing the programming languages and frameworks they employ. In some rare instances, developers have unintentionally exposed sensitive information, including critical data and credentials, within public repositories. These inadvertent revelations may present a unique opportunity us.
Practice
Github Dorks & Sensitive Data Exposure
To automate the process of searching sensitives files and hardcoded credentials in Git repositories, we may use following tools
Github-dorks is a python tools used to search leaked secrets via github search. Its collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc.
# search a single repo
github-dork.py -r techgaun/github-dorks
# search all repos of a user
github-dork.py -u techgaun
# search all repos of an organization
github-dork.py -u dev-nepalAlternatively, we can manualy search for specific dorks, without using Github-dorks :
.png)
Examples of Github Dorks are :
| Dork | Description |
|---|---|
| filename:.npmrc _auth | npm registry authentication data |
| filename:.dockercfg auth | docker registry authentication data |
| extension:pem private | private keys |
| extension:ppk private | puttygen private keys |
| filename:id_rsa or filename:id_dsa | private ssh keys |
| filename:wp-config.php | wordpress config files |
| filename:.env MAIL_HOST=smtp.gmail.com gmail | smtp configuration (try different smtp services too) |
| shodan_api_key language:python | Shodan API keys (try other languages too) |
/"sk-[a-zA-Z0-9]{20,50}"/ language:Shell | Open AI API Keys |
| "api_hash" "api_id" | Telegram API token |
Resources
GitHub - techgaun/github-dorks: Find leaked secrets via github searchgithub.com