Github Dorks & Leaks

Reading time: 7 minutes

git repos और file system में secrets खोजने के लिए टूल्स

• https://github.com/dxa4481/truffleHog
• https://github.com/gitleaks/gitleaks
• https://github.com/praetorian-inc/noseyparker
• https://github.com/GitGuardian/ggshield
• https://github.com/JaimePolop/RExpository
• https://github.com/Yelp/detect-secrets
• https://github.com/hisxo/gitGraber
• https://github.com/eth0izzle/shhgit (unmaintained)
• https://github.com/techgaun/github-dorks
• https://github.com/michenriksen/gitrob (archived)
• https://github.com/anshumanbh/git-all-secrets (archived)
• https://github.com/awslabs/git-secrets
• https://github.com/kootenpv/gittyleaks
• https://github.com/obheda12/GitDorker

नोट्स

• TruffleHog v3 कई credentials को live में verify कर सकता है और GitHub orgs, issues/PRs, gists, और wikis को scan कर सकता है। उदाहरण: trufflehog github --org <ORG> --results=verified.
• Gitleaks v8 git history, directories और archives को scan करना support करता है: gitleaks detect -v --source . या gitleaks detect --source <repo> --log-opts="--all".
• Nosey Parker curated rules के साथ high-throughput scanning पर केंद्रित है और triage के लिए Explorer UI प्रदान करता है। उदाहरण: noseyparker scan --datastore np.db <path|repo> फिर noseyparker report --datastore np.db.
• ggshield (GitGuardian CLI) pre-commit/CI hooks और Docker image scanning प्रदान करता है: ggshield secret scan repo <path-or-url>.

GitHub में जहाँ secrets आमतौर पर leak होते हैं

• Repository files default और non-default branches में (UI में repo:owner/name@branch खोजें)।
• Full git history और अन्य branches/tags (clone करके gitleaks/trufflehog से scan करें; GitHub search indexed content पर focused है)।
• Issues, pull requests, comments, और descriptions (TruffleHog GitHub source इनको flags जैसे --issue-comments, --pr-comments के माध्यम से support करता है)।
• Public repositories के Actions logs और artifacts (masking best-effort है; अगर visible हों तो logs/artifacts की review करें)।
• Wikis और release assets।
• Gists (tooling या UI से खोजें; कुछ tools gists शामिल कर सकते हैं)।

सावधानियाँ

• GitHub का REST code search API legacy है और regex सपोर्ट नहीं करता; regex searches के लिए Web UI पसंद करें। gh CLI legacy API का उपयोग करता है।
• केवल वे files जो एक निश्चित size से नीचे हों search के लिए indexed होते हैं। Thorough होने के लिए, clone करके locally किसी secrets scanner से scan करें।

Programmatic org-wide scanning

• TruffleHog (GitHub source):

export GITHUB_TOKEN=<token>
trufflehog github --org Target --results=verified \
--include-wikis --issue-comments --pr-comments --gist-comments

• Gitleaks सभी org repos पर (shallow clone करके scan):

gh repo list Target --limit 1000 --json nameWithOwner,url \
| jq -r '.[].url' | while read -r r; do
tmp=$(mktemp -d); git clone --depth 1 "$r" "$tmp" && \
gitleaks detect --source "$tmp" -v || true; rm -rf "$tmp";
done

• mono checkout पर एक जिज्ञासु व्यक्ति:

# after cloning many repos beneath ./org
noseyparker scan --datastore np.db org/ && noseyparker report --datastore np.db

• ggshield त्वरित स्कैन:

# current working tree
ggshield secret scan path -r .
# full git history of a repo
ggshield secret scan repo <path-or-url>

सुझाव: git history के लिए, उन scanners को प्राथमिकता दें जो हटाए गए secrets पकड़ने के लिए git log -p --all पार्स करते हैं।

आधुनिक टोकन के लिए Updated dorks

• GitHub tokens: ghp_ gho_ ghu_ ghs_ ghr_ github_pat_
• Slack tokens: xoxb- xoxp- xoxa- xoxs- xoxc- xoxe-
• Cloud and general:
• AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY aws_session_token
• GOOGLE_API_KEY AZURE_TENANT_ID AZURE_CLIENT_SECRET
• OPENAI_API_KEY ANTHROPIC_API_KEY

Dorks

".mlab.com password"
"access_key"
"access_token"
"amazonaws"
"api.googlemaps AIza"
"api_key"
"api_secret"
"apidocs"
"apikey"
"apiSecret"
"app_key"
"app_secret"
"appkey"
"appkeysecret"
"application_key"
"appsecret"
"appspot"
"auth"
"auth_token"
"authorizationToken"
"aws_access"
"aws_access_key_id"
"aws_key"
"aws_secret"
"aws_token"
"AWSSecretKey"
"bashrc password"
"bucket_password"
"client_secret"
"cloudfront"
"codecov_token"
"config"
"conn.login"
"connectionstring"
"consumer_key"
"credentials"
"database_password"
"db_password"
"db_username"
"dbpasswd"
"dbpassword"
"dbuser"
"dot-files"
"dotfiles"
"encryption_key"
"fabricApiSecret"
"fb_secret"
"firebase"
"ftp"
"gh_token"
"github_key"
"github_token"
"gitlab"
"gmail_password"
"gmail_username"
"herokuapp"
"internal"
"irc_pass"
"JEKYLL_GITHUB_TOKEN"
"key"
"keyPassword"
"ldap_password"
"ldap_username"
"login"
"mailchimp"
"mailgun"
"master_key"
"mydotfiles"
"mysql"
"node_env"
"npmrc _auth"
"oauth_token"
"pass"
"passwd"
"password"
"passwords"
"pem private"
"preprod"
"private_key"
"prod"
"pwd"
"pwds"
"rds.amazonaws.com password"
"redis_password"
"root_password"
"secret"
"secret.password"
"secret_access_key"
"secret_key"
"secret_token"
"secrets"
"secure"
"security_credentials"
"send.keys"
"send_keys"
"sendkeys"
"SF_USERNAME salesforce"
"sf_username"
"site.com" FIREBASE_API_JSON=
"site.com" vim_settings.xml
"slack_api"
"slack_token"
"sql_password"
"ssh"
"ssh2_auth_password"
"sshpass"
"staging"
"stg"
"storePassword"
"stripe"
"swagger"
"testuser"
"token"
"x-api-key"
"xoxb "
"xoxp"
[WFClient] Password= extension:ica
access_key
bucket_password
dbpassword
dbuser
extension:avastlic "support.avast.com"
extension:bat
extension:cfg
extension:env
extension:exs
extension:ini
extension:json api.forecast.io
extension:json googleusercontent client_secret
extension:json mongolab.com
extension:pem
extension:pem private
extension:ppk
extension:ppk private
extension:properties
extension:sh
extension:sls
extension:sql
extension:sql mysql dump
extension:sql mysql dump password
extension:yaml mongolab.com
extension:zsh
filename:.bash_history
filename:.bash_history DOMAIN-NAME
filename:.bash_profile aws
filename:.bashrc mailchimp
filename:.bashrc password
filename:.cshrc
filename:.dockercfg auth
filename:.env DB_USERNAME NOT homestead
filename:.env MAIL_HOST=smtp.gmail.com
filename:.esmtprc password
filename:.ftpconfig
filename:.git-credentials
filename:.history
filename:.htpasswd
filename:.netrc password
filename:.npmrc _auth
filename:.pgpass
filename:.remote-sync.json
filename:.s3cfg
filename:.sh_history
filename:.tugboat NOT _tugboat
filename:_netrc password
filename:apikey
filename:bash
filename:bash_history
filename:bash_profile
filename:bashrc
filename:beanstalkd.yml
filename:CCCam.cfg
filename:composer.json
filename:config
filename:config irc_pass
filename:config.json auths
filename:config.php dbpasswd
filename:configuration.php JConfig password
filename:connections
filename:connections.xml
filename:constants
filename:credentials
filename:credentials aws_access_key_id
filename:cshrc
filename:database
filename:dbeaver-data-sources.xml
filename:deployment-config.json
filename:dhcpd.conf
filename:dockercfg
filename:environment
filename:express.conf
filename:express.conf path:.openshift
filename:filezilla.xml
filename:filezilla.xml Pass
filename:git-credentials
filename:gitconfig
filename:global
filename:history
filename:htpasswd
filename:hub oauth_token
filename:id_dsa
filename:id_rsa
filename:id_rsa or filename:id_dsa
filename:idea14.key
filename:known_hosts
filename:logins.json
filename:makefile
filename:master.key path:config
filename:netrc
filename:npmrc
filename:pass
filename:passwd path:etc
filename:pgpass
filename:prod.exs
filename:prod.exs NOT prod.secret.exs
filename:prod.secret.exs
filename:proftpdpasswd
filename:recentservers.xml
filename:recentservers.xml Pass
filename:robomongo.json
filename:s3cfg
filename:secrets.yml password
filename:server.cfg
filename:server.cfg rcon password
filename:settings
filename:settings.py SECRET_KEY
filename:sftp-config.json
filename:sftp-config.json password
filename:sftp.json path:.vscode
filename:shadow
filename:shadow path:etc
filename:spec
filename:sshd_config
filename:token
filename:tugboat
filename:ventrilo_srv.ini
filename:WebServers.xml
filename:wp-config
filename:wp-config.php
filename:zhrc
HEROKU_API_KEY language:json
HEROKU_API_KEY language:shell
HOMEBREW_GITHUB_API_TOKEN language:shell
jsforce extension:js conn.login
language:yaml -filename:travis
msg nickserv identify filename:config
org:Target "AWS_ACCESS_KEY_ID"
org:Target "list_aws_accounts"
org:Target "aws_access_key"
org:Target "aws_secret_key"
org:Target "bucket_name"
org:Target "S3_ACCESS_KEY_ID"
org:Target "S3_BUCKET"
org:Target "S3_ENDPOINT"
org:Target "S3_SECRET_ACCESS_KEY"
password
path:sites databases password
private -language:java
PT_TOKEN language:bash
redis_password
root_password
secret_access_key
SECRET_KEY_BASE=
shodan_api_key language:python
WORDPRESS_DB_PASSWORD=
xoxp OR xoxb OR xoxa
s3.yml
.exs
beanstalkd.yml
deploy.rake
.sls
AWS_SECRET_ACCESS_KEY
API KEY
API SECRET
API TOKEN
ROOT PASSWORD
ADMIN PASSWORD
GCP SECRET
AWS SECRET
"private" extension:pgp

Wide Source Code Search

संदर्भ

• सार्वजनिक रिपॉजिटरीज़ से secrets को बाहर रखना (GitHub Blog, Feb 29, 2024): https://github.blog/news-insights/product-news/keeping-secrets-out-of-public-repositories/
• TruffleHog v3 – Find, verify, and analyze leaked credentials: https://github.com/trufflesecurity/trufflehog