Skip to content

Commit 70c5625

Browse files
techgauntechgaun
committed
feat: add categorized dork dictionaries
1 parent 118d70b commit 70c5625

16 files changed

Lines changed: 430 additions & 135 deletions

‎README.md‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,10 @@ github-dorks -r techgaun/github-dorks --format json # stream JSON to s
6868
github-dorks -u dev-nepal --format jsonl -o results.jsonl # write newline-delimited JSON
6969

7070
github-dorks -u dev-nepal --format csv -o results.csv --force # explicitly replace an existing file
71+
72+
github-dorks --list-categories # list bundled dictionaries
73+
74+
github-dorks -r techgaun/github-dorks -c cloud -c devops # scan selected categories
7175
```
7276

7377
The legacy `python github-dork.py ...` invocation remains available for
@@ -85,6 +89,13 @@ provided. Use `--quiet` to suppress progress and summaries, or `--verbose` to
8589
print every query as it runs. Structured stdout remains machine-readable because
8690
status messages are sent to stderr.
8791

92+
The bundled dictionary is split into `cloud`, `databases`, `devops`,
93+
`frameworks`, `private-keys`, `saas`, and `system` categories. Repeat
94+
`-c/--category` to combine categories. With no category or custom `--dork`
95+
file, the command uses the backward-compatible `github-dorks.txt` aggregate.
96+
That aggregate is generated from the category files with
97+
`python scripts/build-dorks.py`.
98+
8899
### Development
89100

90101
Run the dependency-free unit test suite with:
@@ -99,17 +110,20 @@ The CI test matrix covers Python 3.10 through 3.13.
99110

100111
- Authenticated requests receive higher rate limits. Searches may pause until
101112
GitHub resets the search limit.
102-
- Search results can be printed to the terminal or written as CSV.
113+
- Large category combinations can take time because GitHub applies a separate
114+
search rate limit.
103115

104116
### Contribution
105117

106-
Please consider contributing dorks that can reveal potentially sensitive information on Github.
118+
Please consider contributing dorks that can reveal potentially sensitive information on GitHub.
107119
Documented sources for newer credential families are maintained in
108120
[docs/dork-sources.md](docs/dork-sources.md).
109121

110122
### List of Dorks
111123

112-
The canonical, categorized dictionary is [github-dorks.txt](github-dorks.txt).
124+
The canonical dictionaries are the [categorized files](github_dorks/dorks).
125+
The generated [github-dorks.txt](github-dorks.txt) file contains every category
126+
for backward compatibility.
113127
The table below provides descriptions for many established patterns; newer
114128
credential families and their vendor references are tracked in
115129
[docs/dork-sources.md](docs/dork-sources.md). Many dorks can be modified to make

‎docs/dork-sources.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
# Dork source references
22

3-
The primary `github-dorks.txt` dictionary favors documented token prefixes and
4-
canonical environment-variable names. Prefixes generally produce stronger
5-
signals; variable-name searches also catch providers that do not guarantee a
6-
stable public token format.
3+
The dictionaries in `github_dorks/dorks/` favor documented token prefixes and
4+
canonical environment-variable names. The generated `github-dorks.txt`
5+
aggregate contains every category for backward compatibility. Prefixes
6+
generally produce stronger signals; variable-name searches also catch providers
7+
that do not guarantee a stable public token format.
78

89
These references support the modern credential families added to the
910
dictionary. They are not exhaustive, and a match still requires manual review.

‎github-dorks.txt‎

Lines changed: 108 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -1,141 +1,149 @@
1-
filename:.npmrc _auth
2-
filename:.dockercfg auth
3-
extension:pem private
4-
extension:ppk private
5-
filename:id_rsa or filename:id_dsa
6-
extension:sql mysql dump
7-
extension:sql mysql dump password
1+
# Generated by scripts/build-dorks.py. Edit github_dorks/dorks/*.txt.
2+
3+
# Category: cloud
4+
# Cloud provider, infrastructure, observability, and deployment credentials
85
filename:credentials aws_access_key_id
96
filename:.s3cfg
7+
filename:.bash_profile aws
8+
rds.amazonaws.com password
9+
extension:json googleusercontent client_secret
10+
extension:yaml cloud.redislabs.com
11+
extension:json cloud.redislabs.com
12+
DATADOG_API_KEY language:shell
13+
"CLOUDFLARE_API_TOKEN" path:.env
14+
"DIGITALOCEAN_ACCESS_TOKEN" path:.env
15+
"dop_v1_"
16+
"PULUMI_ACCESS_TOKEN" path:.env
17+
"TFE_TOKEN" path:.env
18+
"atlasv1" filename:credentials.tfrc.json
19+
"VERCEL_TOKEN" path:.env
20+
"SUPABASE_SERVICE_ROLE_KEY" path:.env
21+
"SENTRY_AUTH_TOKEN" path:.env
22+
"sntrys_"
23+
filename:service-account.json "private_key_id" "private_key"
24+
"GOOGLE_PRIVATE_KEY" path:.env
25+
26+
# Category: databases
27+
# Database dumps, configuration, credentials, and connection strings
28+
extension:sql mysql dump
29+
extension:sql mysql dump password
30+
extension:json mongolab.com
31+
extension:yaml mongolab.com
32+
filename:robomongo.json
33+
filename:connections.xml
34+
filename:.pgpass
35+
filename:configuration.php JConfig password
36+
filename:config.php dbpasswd
37+
filename:config.php pass
38+
path:sites databases password
39+
filename:dbeaver-data-sources.xml
40+
.mlab.com password
41+
"mongodb+srv://" password
42+
"postgres://" password
43+
44+
# Category: devops
45+
# Source control, CI/CD, and package registry credentials
46+
filename:.npmrc _auth
47+
filename:.dockercfg auth
48+
filename:.git-credentials
49+
filename:.tugboat NOT _tugboat
50+
HEROKU_API_KEY language:shell
51+
HEROKU_API_KEY language:json
52+
filename:hub oauth_token
53+
filename:config.json auths
54+
filename:express.conf path:.openshift
55+
JEKYLL_GITHUB_TOKEN
56+
HOMEBREW_GITHUB_API_TOKEN language:shell
57+
filename:deployment-config.json
58+
"github_pat_"
59+
"ghp_"
60+
"gho_" OR "ghu_" OR "ghs_" OR "ghr_"
61+
"glpat-"
62+
"gloas-" OR "gldt-"
63+
"glrt-" OR "glrtr-" OR "glcbt-" OR "glptt-"
64+
filename:.npmrc "_authToken="
65+
"pypi-" filename:.pypirc
66+
"NUGET_API_KEY" path:.env
67+
"GEM_HOST_API_KEY" path:.env
68+
69+
# Category: frameworks
70+
# Web framework and application configuration secrets
1071
filename:wp-config.php
11-
filename:.htpasswd
1272
filename:.env DB_USERNAME NOT homestead
1373
filename:.env MAIL_HOST=smtp.gmail.com
14-
filename:.git-credentials
74+
filename:prod.exs NOT prod.secret.exs
75+
filename:prod.secret.exs
76+
filename:settings.py SECRET_KEY
77+
filename:secrets.yml password
78+
79+
# Category: private-keys
80+
# Cryptographic private keys and decryption keys
81+
extension:pem private
82+
extension:ppk private
83+
filename:id_rsa or filename:id_dsa
84+
filename:master.key path:config
85+
"-----BEGIN OPENSSH PRIVATE KEY-----"
86+
"-----BEGIN PRIVATE KEY-----"
87+
"AGE-SECRET-KEY-1"
88+
89+
# Category: saas
90+
# SaaS, AI, payment, and communications credentials
1591
PT_TOKEN language:bash
16-
filename:.bashrc password
1792
filename:.bashrc mailchimp
18-
filename:.bash_profile aws
19-
rds.amazonaws.com password
2093
extension:json api.forecast.io
21-
extension:json mongolab.com
22-
extension:yaml mongolab.com
2394
jsforce extension:js conn.login
2495
SF_USERNAME salesforce
25-
filename:.tugboat NOT _tugboat
26-
HEROKU_API_KEY language:shell
27-
HEROKU_API_KEY language:json
96+
shodan_api_key language:python
97+
shodan_api_key language:shell
98+
shodan_api_key language:json
99+
shodan_api_key language:ruby
100+
extension:avastlic "support.avast.com"
101+
xoxp OR xoxb
102+
"api_hash" "api_id"
103+
"https://hooks.slack.com/services/"
104+
"OPENAI_API_KEY" path:.env
105+
"ANTHROPIC_API_KEY" path:.env
106+
"sk-ant-"
107+
"HF_TOKEN" path:.env
108+
"hf_" filename:token path:huggingface
109+
"sk_live_" OR "rk_live_"
110+
"SENDGRID_API_KEY" path:.env
111+
"TWILIO_AUTH_TOKEN" path:.env
112+
"SLACK_BOT_TOKEN" path:.env
113+
"DISCORD_BOT_TOKEN" path:.env
114+
115+
# Category: system
116+
# Operating system, shell, server, IDE, and client configuration secrets
117+
filename:.htpasswd
118+
filename:.bashrc password
28119
filename:.netrc password
29120
filename:_netrc password
30-
filename:hub oauth_token
31-
filename:robomongo.json
32121
filename:filezilla.xml Pass
33122
filename:recentservers.xml Pass
34-
filename:config.json auths
35123
filename:idea14.key
36124
filename:config irc_pass
37-
filename:connections.xml
38-
filename:express.conf path:.openshift
39-
filename:.pgpass
40125
filename:proftpdpasswd
41126
filename:ventrilo_srv.ini
42127
[WFClient] Password= extension:ica
43128
filename:server.cfg rcon password
44-
JEKYLL_GITHUB_TOKEN
45129
filename:.bash_history
46130
filename:.cshrc
47131
filename:.history
48132
filename:.sh_history
49133
filename:sshd_config
50134
filename:dhcpd.conf
51-
filename:prod.exs NOT prod.secret.exs
52-
filename:prod.secret.exs
53-
filename:configuration.php JConfig password
54-
filename:config.php dbpasswd
55-
filename:config.php pass
56-
path:sites databases password
57-
shodan_api_key language:python
58-
shodan_api_key language:shell
59-
shodan_api_key language:json
60-
shodan_api_key language:ruby
61135
filename:shadow path:etc
62136
filename:passwd path:etc
63-
extension:avastlic "support.avast.com"
64-
filename:dbeaver-data-sources.xml
65137
filename:sftp-config.json
66138
filename:.esmtprc password
67-
extension:json googleusercontent client_secret
68-
HOMEBREW_GITHUB_API_TOKEN language:shell
69-
xoxp OR xoxb
70-
.mlab.com password
71139
filename:logins.json
72140
filename:CCCam.cfg
73141
msg nickserv identify filename:config
74-
filename:settings.py SECRET_KEY
75-
filename:secrets.yml password
76-
filename:master.key path:config
77-
filename:deployment-config.json
78142
filename:.ftpconfig
79143
filename:.remote-sync.json
80144
filename:sftp.json path:.vscode
81145
filename:WebServers.xml
82146
filename:jupyter_notebook_config.json
83-
"api_hash" "api_id"
84-
"https://hooks.slack.com/services/"
85147
filename:github-recovery-codes.txt
86148
filename:gitlab-recovery-codes.txt
87149
filename:discord_backup_codes.txt
88-
extension:yaml cloud.redislabs.com
89-
extension:json cloud.redislabs.com
90-
DATADOG_API_KEY language:shell
91-
92-
# Git hosting and CI/CD tokens
93-
"github_pat_"
94-
"ghp_"
95-
"gho_" OR "ghu_" OR "ghs_" OR "ghr_"
96-
"glpat-"
97-
"gloas-" OR "gldt-"
98-
"glrt-" OR "glrtr-" OR "glcbt-" OR "glptt-"
99-
100-
# Package registry tokens
101-
filename:.npmrc "_authToken="
102-
"pypi-" filename:.pypirc
103-
"NUGET_API_KEY" path:.env
104-
"GEM_HOST_API_KEY" path:.env
105-
106-
# AI and machine learning provider credentials
107-
"OPENAI_API_KEY" path:.env
108-
"ANTHROPIC_API_KEY" path:.env
109-
"sk-ant-"
110-
"HF_TOKEN" path:.env
111-
"hf_" filename:token path:huggingface
112-
113-
# Cloud, infrastructure, and deployment credentials
114-
"CLOUDFLARE_API_TOKEN" path:.env
115-
"DIGITALOCEAN_ACCESS_TOKEN" path:.env
116-
"dop_v1_"
117-
"PULUMI_ACCESS_TOKEN" path:.env
118-
"TFE_TOKEN" path:.env
119-
"atlasv1" filename:credentials.tfrc.json
120-
"VERCEL_TOKEN" path:.env
121-
"SUPABASE_SERVICE_ROLE_KEY" path:.env
122-
"SENTRY_AUTH_TOKEN" path:.env
123-
"sntrys_"
124-
125-
# Payment and communications credentials
126-
"sk_live_" OR "rk_live_"
127-
"SENDGRID_API_KEY" path:.env
128-
"TWILIO_AUTH_TOKEN" path:.env
129-
"SLACK_BOT_TOKEN" path:.env
130-
"DISCORD_BOT_TOKEN" path:.env
131-
132-
# Database connection strings and service accounts
133-
"mongodb+srv://" password
134-
"postgres://" password
135-
filename:service-account.json "private_key_id" "private_key"
136-
"GOOGLE_PRIVATE_KEY" path:.env
137-
138-
# Modern private key formats
139-
"-----BEGIN OPENSSH PRIVATE KEY-----"
140-
"-----BEGIN PRIVATE KEY-----"
141-
"AGE-SECRET-KEY-1"

‎github_dorks/cli.py‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,11 @@
99
import github3 as github
1010

1111
from github_dorks import __version__
12+
from github_dorks.dictionaries import available_categories
1213
from github_dorks.search import create_client, search
1314

1415

15-
def monitor(gh_dorks_file=None, feed_token=None, refresh_time=60):
16+
def monitor(gh_dorks_file=None, feed_token=None, refresh_time=60, categories=None):
1617
github_user = os.getenv('GH_USER')
1718
if github_user is None:
1819
raise ValueError('GH_USER is required for monitoring')
@@ -27,6 +28,7 @@ def monitor(gh_dorks_file=None, feed_token=None, refresh_time=60):
2728
search(
2829
user_to_search=item['author_detail']['name'],
2930
gh_dorks_file=gh_dorks_file,
31+
categories=categories,
3032
)
3133
seen_items.add(item['title'])
3234
print('Waiting for new items...')
@@ -55,10 +57,20 @@ def build_parser():
5557
'-m', '--monit', dest='active_monit',
5658
help='Monitor the GitHub user private feed with this feed token',
5759
)
58-
parser.add_argument(
60+
group.add_argument(
61+
'--list-categories', action='store_true',
62+
help='List bundled dictionary categories and exit',
63+
)
64+
dictionary_group = parser.add_mutually_exclusive_group()
65+
dictionary_group.add_argument(
5966
'-d', '--dork', dest='gh_dorks_file',
6067
help='GitHub dorks file. Eg: github-dorks.txt',
6168
)
69+
dictionary_group.add_argument(
70+
'-c', '--category', action='append', dest='categories',
71+
choices=available_categories(),
72+
help='Bundled category to scan; repeat to select multiple',
73+
)
6274
parser.add_argument(
6375
'-o', '--output', '--outputFile', dest='output_filename',
6476
help='Write results to this file instead of stdout',
@@ -91,16 +103,23 @@ def build_parser():
91103
def main():
92104
parser = build_parser()
93105
args = parser.parse_args()
106+
if args.list_categories:
107+
print('\n'.join(available_categories()))
108+
return 0
94109
if args.max_retries < 0:
95110
parser.error('--max-retries must be zero or greater')
96111
try:
97112
if args.active_monit:
98-
monitor(args.gh_dorks_file, args.active_monit)
113+
monitor(
114+
args.gh_dorks_file, args.active_monit,
115+
categories=args.categories,
116+
)
99117
return 0
100118
stats = search(
101119
repo_to_search=args.repo_to_search,
102120
user_to_search=args.user_to_search,
103121
gh_dorks_file=args.gh_dorks_file,
122+
categories=args.categories,
104123
output_filename=args.output_filename,
105124
output_format=args.output_format,
106125
force=args.force,

0 commit comments

Comments
 (0)