Skip to content

Commit b60fe26

Browse files
techgauntechgaun
committed
Merge pull request #4 from mesaugat/patch-2
Stop execution if a github exception occurs and formatting of dork lists.
2 parents db0f2b4 + 8e0352a commit b60fe26

2 files changed

Lines changed: 61 additions & 93 deletions

File tree

‎README.md‎

Lines changed: 49 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -13,25 +13,24 @@ pip install -r requirements.txt
1313
```
1414

1515
#### Usage
16-
1716
```
18-
GH_USER - Environment variable to specify github user
19-
GH_PWD - Environment variable to specify password
17+
GH_USER - Environment variable to specify github user
18+
GH_PWD - Environment variable to specify password
2019
GH_TOKEN - Environment variable to specify github token
2120
```
2221

2322
Some example usages are listed below:
2423

2524
```shell
26-
python github-dork.py -r techgaun/github-dorks # search single repo
25+
python github-dork.py -r techgaun/github-dorks # search single repo
2726

28-
python github-dork.py -u techgaun # search all repos of user
27+
python github-dork.py -u techgaun # search all repos of user
2928

30-
python github-dork.py -u dev-nepal # search all repos of an organization
29+
python github-dork.py -u dev-nepal # search all repos of an organization
3130

3231
GH_USER=techgaun GH_PWD=<mypass> python github-dork.py -u dev-nepal # search as authenticated user
3332

34-
GH_TOKEN=<github_token> python github-dork.py -u dev-nepal # search using auth token
33+
GH_TOKEN=<github_token> python github-dork.py -u dev-nepal # search using auth token
3534
```
3635

3736
#### Limitations
@@ -44,82 +43,46 @@ GH_TOKEN=<github_token> python github-dork.py -u dev-nepal # search using a
4443
Please consider contributing the dorks that can reveal potentially senstive information in github.
4544

4645
### List of Dorks
47-
List of dorks follow. I am not categorizing at the moment. Instead am going to just the list of dorks with optionally a description separated by # in the same line. Many of the dorks can be modified to make the search more specific or generic. You can see more options [HERE](https://github.com/search#search_cheatsheet_pane).
48-
49-
```
50-
filename:.npmrc _auth # npm registry authentication data
51-
52-
filename:.dockercfg auth # docker registry authentication data
53-
54-
extension:pem private # private keys
55-
56-
extension:ppk private # puttygen private keys
57-
58-
filename:id_rsa or filename:id_dsa # private ssh keys
59-
60-
extension:sql mysql dump # mysql dump
61-
62-
extension:sql mysql dump password # mysql dump look for password; you can try varieties
63-
64-
filename:credentials aws_access_key_id # might return false negatives with dummy values
65-
66-
filename:.s3cfg # might return false negatives with dummy values
67-
68-
filename:wp-config.php # wordpress config files
69-
70-
filename:.htpasswd # htpasswd files
71-
72-
filename:.env DB_USERNAME NOT homestead # laravel .env (CI, various ruby based frameworks too)
73-
74-
filename:.env MAIL_HOST=smtp.gmail.com # gmail smtp configuration (try different smtp services too)
75-
76-
filename:.git-credentials # git credentials store, add NOT username for more valid results
77-
78-
PT_TOKEN language:bash # pivotaltracker tokens
79-
80-
filename:.bashrc password # search for passwords, etc. in .bashrc (try with .bash_profile too)
81-
82-
filename:.bashrc mailchimp # variation of above (try more variations)
83-
84-
filename:.bash_profile aws # aws access and secret keys
85-
86-
rds.amazonaws.com password # Amazon RDS possible credentials
87-
88-
extension:json api.forecast.io # try variations, find api keys/secrets
89-
90-
extension:json mongolab.com # mongolab credentials in json configs
91-
92-
extension:yaml mongolab.com # mongolab credentials in yaml configs (try with yml)
93-
94-
jsforce extension:js conn.login # possible salesforce credentials in nodejs projects
95-
96-
SF_USERNAME "salesforce" # possible salesforce credentials
97-
98-
filename:.tugboat NOT "_tugboat" # Digital Ocean tugboat config
99-
100-
HEROKU_API_KEY language:shell # Heroku api keys
101-
102-
HEROKU_API_KEY language:json # Heroku api keys in json files
103-
104-
filename:.netrc password # netrc that possibly holds sensitive credentials
105-
106-
filename:_netrc password # netrc that possibly holds sensitive credentials
107-
108-
filename:hub oauth_token # hub config that stores github tokens
109-
110-
filename:robomongo.json # mongodb credentials file used by robomongo
111-
112-
filename:filezilla.xml Pass # filezilla config file with possible user/pass to ftp
113-
114-
filename:recentservers.xml Pass # filezilla config file with possible user/pass to ftp
115-
116-
filename:config.json auths # docker registry authentication data
117-
118-
filename:idea14.key # IntelliJ Idea 14 key, try variations for other versions
119-
120-
filename:config irc_pass # possible IRC config
121-
122-
filename:connections.xml # possible db connections configuration, try variations to be specific
123-
124-
filename:express.conf path:.openshift # openshift config, only email and server though
125-
```
46+
I am not categorizing at the moment. Instead I am going to just the list of dorks with a description. Many of the dorks can be modified to make the search more specific or generic. You can see more options [here](https://github.com/search#search_cheatsheet_pane).
47+
48+
Dork | Description
49+
------------------------------------------------|--------------------------------------------------------------------------
50+
filename:.npmrc _auth | npm registry authentication data
51+
filename:.dockercfg auth | docker registry authentication data
52+
extension:pem private | private keys
53+
extension:ppk private | puttygen private keys
54+
filename:id_rsa or filename:id_dsa | private ssh keys
55+
extension:sql mysql dump | mysql dump
56+
extension:sql mysql dump password | mysql dump look for password; you can try varieties
57+
filename:credentials aws_access_key_id | might return false negatives with dummy values
58+
filename:.s3cfg | might return false negatives with dummy values
59+
filename:wp-config.php | wordpress config files
60+
filename:.htpasswd | htpasswd files
61+
filename:.env DB_USERNAME NOT homestead | laravel .env (CI, various ruby based frameworks too)
62+
filename:.env MAIL_HOST=smtp.gmail.com | gmail smtp configuration (try different smtp services too)
63+
filename:.git-credentials | git credentials store, add NOT username for more valid results
64+
PT_TOKEN language:bash | pivotaltracker tokens
65+
filename:.bashrc password | search for passwords, etc. in .bashrc (try with .bash_profile too)
66+
filename:.bashrc mailchimp | variation of above (try more variations)
67+
filename:.bash_profile aws | aws access and secret keys
68+
rds.amazonaws.com password | Amazon RDS possible credentials
69+
extension:json api.forecast.io | try variations, find api keys/secrets
70+
extension:json mongolab.com | mongolab credentials in json configs
71+
extension:yaml mongolab.com | mongolab credentials in yaml configs (try with yml)
72+
jsforce extension:js conn.login | possible salesforce credentials in nodejs projects
73+
SF_USERNAME "salesforce" | possible salesforce credentials
74+
filename:.tugboat NOT "_tugboat" | Digital Ocean tugboat config
75+
HEROKU_API_KEY language:shell | Heroku api keys
76+
HEROKU_API_KEY language:json | Heroku api keys in json files
77+
filename:.netrc password | netrc that possibly holds sensitive credentials
78+
filename:_netrc password | netrc that possibly holds sensitive credentials
79+
filename:hub oauth_token | hub config that stores github tokens
80+
filename:robomongo.json | mongodb credentials file used by robomongo
81+
filename:filezilla.xml Pass | filezilla config file with possible user/pass to ftp
82+
filename:recentservers.xml Pass | filezilla config file with possible user/pass to ftp
83+
filename:config.json auths | docker registry authentication data
84+
filename:idea14.key | IntelliJ Idea 14 key, try variations for other versions
85+
filename:config irc_pass | possible IRC config
86+
filename:connections.xml | possible db connections configuration, try variations to be specific
87+
filename:express.conf path:.openshift | openshift config, only email and server thou
88+
filename:.pgpass | PostgreSQL file which can contain passwords

‎github-dork.py‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,21 +45,23 @@ def search(repo_to_search=None, user_to_search=None, gh_dorks_file=None):
4545
'score': search_result.score,
4646
'url': search_result.html_url
4747
}
48-
print(
49-
'''Found result for {dork}
50-
Text matches: {text_matches}
51-
File path: {path}
52-
Score/Relevance: {score}
53-
URL of File: {url}
48+
print('''
49+
Found result for {dork}
50+
Text matches: {text_matches}
51+
File path: {path}
52+
Score/Relevance: {score}
53+
URL of File: {url}
5454
'''.format(**fmt_args)
5555
)
5656
except github.exceptions.ForbiddenError as e:
5757
print(e)
58+
return
5859
# need to retry in case of API rate limit reached
59-
# note done yet
60+
# not done yet
6061
except github.exceptions.GitHubError as e:
6162
print('GitHubError encountered on search of dork: ' + dork)
6263
print(e)
64+
return
6365
except Exception as e:
6466
print('Error encountered on search of dork: ' + dork)
6567

@@ -72,12 +74,14 @@ def main():
7274
description='Search github for github dorks',
7375
epilog='Use responsibly, Enjoy pentesting'
7476
)
77+
7578
parser.add_argument(
7679
'-v',
7780
'--version',
7881
action='version',
7982
version='%(prog)s 0.1.0'
8083
)
84+
8185
group = parser.add_mutually_exclusive_group(required=True)
8286
group.add_argument(
8387
'-u',
@@ -86,6 +90,7 @@ def main():
8690
action='store',
8791
help='Github user/org to search within. Eg: techgaun'
8892
)
93+
8994
group.add_argument(
9095
'-r',
9196
'--repo',

0 commit comments

Comments
 (0)