GitHub Dorking: The Hunter’s Guide to Finding Secrets in Public Code

# Basic operators
filename:      # Search within specific files
extension:     # Filter by file extension
path:          # Search in specific paths
org:           # Limit to organization
repo:          # Search specific repository

# Advanced filters
pushed:        # Based on last push date
created:       # Repository creation date
language:      # Programming language
Combination Operators

# Multiple conditions
filename:.env AND "API_KEY"
org:companyname extension:json "password"

# Environment variables
filename:.env "API_KEY"
filename:.env "DATABASE_URL"
filename:.env "SECRET_KEY"

# Configuration files
filename:config.json "password"
filename:settings.py "SECRET_KEY"
filename:application.properties "spring.datasource.password"
Hunting Exposed Credentials

# AWS credentials
"AWS_ACCESS_KEY_ID" AND "AWS_SECRET_ACCESS_KEY"
filename:.aws/credentials
"AKIA" extension:env

# Database connections
"mongodb://" "password"
"postgresql://" "username"
"mysql://" "root:@"

# API Keys and Tokens
"api_key" extension:json
"gh_token" OR "github_token"
"x-api-key" filename:.config
Corporate Secrets and Internal Data

# Company-specific secrets
org:targetcompany "internal"
filename:internal "confidential"
"proprietary" extension:md

# Financial information
"stripe_key" OR "stripe_secret"
"paypal_client_id" "paypal_secret"
"braintree" "merchant_id"

# Recent exposures
pushed:>2024-01-01 filename:.env "password"
created:>2023-12-01 "API_KEY"

# Historical commits
"remove password" pushed:<2023-01-01
"fix security" created:2022-01-01..2022-12-31
Language-Specific Hunting

# Python projects
language:python "SECRET_KEY" filename:settings.py
language:python "os.environ.get" filename:.py

# JavaScript/Node.js
language:javascript "process.env" filename:.js
language:typescript "config.password" filename:.ts

# Java applications
language:java "getProperty.*password" filename:.java

# Discovery Query:
filename:.env "AWS_ACCESS_KEY_ID" AND "AWS_SECRET_ACCESS_KEY"

# Impact:
- Full AWS account compromise
- 50+ EC2 instances accessible
- S3 buckets with customer data exposed
- Bounty: $2,500
Case Study 2: Database Credentials in Docker Configs

# Discovery Query:
filename:docker-compose.yml "MYSQL_ROOT_PASSWORD"
filename:docker-compose "DATABASE_URL"

# Impact:
- Production database access
- 100,000 user records exposed
- Payment information accessible
- Bounty: $3,000

# GitLeaks
gitleaks detect --source=/path/to/repo --verbose

# TruffleHog
trufflehog filesystem /path/to/repo

# Repo-supervisor
npx repo-supervisor --repo https://github.com/user/repo
Custom Automation Script

#!/usr/bin/env python3
import requests
import re

def github_dork_search(query):
    headers = {'Authorization': 'token YOUR_GITHUB_TOKEN'}
    url = f"https://api.github.com/search/code?q={query}"
    response = requests.get(url, headers=headers)
    return response.json()

# Example usage
results = github_dork_search('filename:.env+API_KEY+org:targetcompany')

Subject: Security Report - Exposed Credentials on GitHub

## Summary
Discovered exposed [type of secret] in your GitHub repository.

## Details
- Repository: [URL]
- File: [filename]
- Exposed Data: [specific credentials]
- Risk Level: [High/Medium/Low]

## Impact Analysis
- [Potential consequences]
- [Recommended actions]

## Proof of Concept
[Code snippets or screenshots]

## Remediation Steps
1. Immediately rotate exposed credentials
2. Remove sensitive files from git history
3. Implement pre-commit hooks

Section 8:
Defensive Measures for Developers
Prevention Strategies

# .gitignore essentials
.env
.key
.pem
config/.json

# Pre-commit hooks
#!/bin/bash
if git diff --cached --name-only | grep -E '\.env|config.json'; then
    echo "Potential secrets in commit. Aborting."
    exit 1
fi