Github Dorks & Leaks

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ

Tools to find secrets in git repos and file system

๋…ธํŠธ

  • TruffleHog v3๋Š” ๋งŽ์€ ์ž๊ฒฉ ์ฆ๋ช…(credentials)์„ ์‹ค์‹œ๊ฐ„์œผ๋กœ ๊ฒ€์ฆํ•˜๊ณ  GitHub orgs, issues/PRs, gists, wikis๋ฅผ ์Šค์บ”ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์˜ˆ: trufflehog github --org <ORG> --results=verified.
  • Gitleaks v8์€ git history, ๋””๋ ‰ํ„ฐ๋ฆฌ ๋ฐ ์•„์นด์ด๋ธŒ ์Šค์บ”์„ ์ง€์›ํ•ฉ๋‹ˆ๋‹ค: gitleaks detect -v --source . ๋˜๋Š” gitleaks detect --source <repo> --log-opts="--all".
  • Nosey Parker๋Š” ์„ ๋ณ„๋œ ๊ทœ์น™์œผ๋กœ ๊ณ ์ฒ˜๋ฆฌ๋Ÿ‰ ์Šค์บ”์— ์ค‘์ ์„ ๋‘๋ฉฐ triage์šฉ Explorer UI๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ: noseyparker scan --datastore np.db <path|repo> ๊ทธ๋Ÿฐ ๋‹ค์Œ noseyparker report --datastore np.db.
  • ggshield (GitGuardian CLI)๋Š” pre-commit/CI ํ›…๊ณผ Docker ์ด๋ฏธ์ง€ ์Šค์บ”์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค: ggshield secret scan repo <path-or-url>.

Where secrets commonly leak in GitHub

  • Repository files in default and non-default branches (search repo:owner/name@branch in the UI).
  • Full git history and other branches/tags (clone and scan with gitleaks/trufflehog; GitHub search focuses on indexed content).
  • Issues, pull requests, comments, and descriptions (TruffleHog GitHub source supports these via flags like --issue-comments, --pr-comments).
  • Actions logs and artifacts of public repositories (masking is best-effort; review logs/artifacts if visible).
  • Wikis and release assets.
  • Gists (search with tooling or the UI; some tools can include gists).

์ฃผ์˜์‚ฌํ•ญ

  • GitHub์˜ REST code search API๋Š” ๋ ˆ๊ฑฐ์‹œ์ด๋ฉฐ ์ •๊ทœ์‹(Regex)์„ ์ง€์›ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค; ์ •๊ทœ์‹ ๊ฒ€์ƒ‰์—๋Š” Web UI๋ฅผ ๊ถŒ์žฅํ•ฉ๋‹ˆ๋‹ค. gh CLI๋Š” ๋ ˆ๊ฑฐ์‹œ API๋ฅผ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค.
  • ๊ฒ€์ƒ‰ ์ธ๋ฑ์‹ฑ์€ ํŠน์ • ํฌ๊ธฐ ์ดํ•˜์˜ ํŒŒ์ผ๋งŒ ํฌํ•จํ•ฉ๋‹ˆ๋‹ค. ์ฒ ์ €ํžˆ ํ™•์ธํ•˜๋ ค๋ฉด ๋ฆฌํฌ์ง€ํ† ๋ฆฌ๋ฅผ cloneํ•˜๊ณ  ๋กœ์ปฌ์—์„œ secrets ์Šค์บ๋„ˆ๋กœ ์Šค์บ”ํ•˜์„ธ์š”.

Programmatic org-wide scanning

  • TruffleHog (GitHub source):
export GITHUB_TOKEN=<token>
trufflehog github --org Target --results=verified \
--include-wikis --issue-comments --pr-comments --gist-comments
  • Gitleaks๋ฅผ ๋ชจ๋“  org ์ €์žฅ์†Œ์—์„œ ์‹คํ–‰(์–•๊ฒŒ ํด๋ก ํ•œ ๋’ค ์Šค์บ”):
gh repo list Target --limit 1000 --json nameWithOwner,url \
| jq -r '.[].url' | while read -r r; do
tmp=$(mktemp -d); git clone --depth 1 "$r" "$tmp" && \
gitleaks detect --source "$tmp" -v || true; rm -rf "$tmp";
done
  • mono checkout ์œ„์—์„œ ๊ผฌ์น˜๊ผฌ์น˜ ์บ๋ฌป๋Š” ์‚ฌ๋žŒ:
# after cloning many repos beneath ./org
noseyparker scan --datastore np.db org/ && noseyparker report --datastore np.db
  • ggshield ๋น ๋ฅธ ์Šค์บ”:
# current working tree
ggshield secret scan path -r .
# full git history of a repo
ggshield secret scan repo <path-or-url>

ํŒ: git ํžˆ์Šคํ† ๋ฆฌ์˜ ๊ฒฝ์šฐ, ์ œ๊ฑฐ๋œ secrets๋ฅผ ํฌ์ฐฉํ•˜๊ธฐ ์œ„ํ•ด git log -p --all์„ ํŒŒ์‹ฑํ•˜๋Š” ์Šค์บ๋„ˆ๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒƒ์ด ์ข‹์Šต๋‹ˆ๋‹ค.

ํ˜„๋Œ€ ํ† ํฐ์„ ์œ„ํ•œ ์—…๋ฐ์ดํŠธ๋œ dorks

  • GitHub tokens: ghp_ gho_ ghu_ ghs_ ghr_ github_pat_
  • Slack tokens: xoxb- xoxp- xoxa- xoxs- xoxc- xoxe-
  • Cloud and general:
  • AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY aws_session_token
  • GOOGLE_API_KEY AZURE_TENANT_ID AZURE_CLIENT_SECRET
  • OPENAI_API_KEY ANTHROPIC_API_KEY

Dorks

".mlab.com password"
"access_key"
"access_token"
"amazonaws"
"api.googlemaps AIza"
"api_key"
"api_secret"
"apidocs"
"apikey"
"apiSecret"
"app_key"
"app_secret"
"appkey"
"appkeysecret"
"application_key"
"appsecret"
"appspot"
"auth"
"auth_token"
"authorizationToken"
"aws_access"
"aws_access_key_id"
"aws_key"
"aws_secret"
"aws_token"
"AWSSecretKey"
"bashrc password"
"bucket_password"
"client_secret"
"cloudfront"
"codecov_token"
"config"
"conn.login"
"connectionstring"
"consumer_key"
"credentials"
"database_password"
"db_password"
"db_username"
"dbpasswd"
"dbpassword"
"dbuser"
"dot-files"
"dotfiles"
"encryption_key"
"fabricApiSecret"
"fb_secret"
"firebase"
"ftp"
"gh_token"
"github_key"
"github_token"
"gitlab"
"gmail_password"
"gmail_username"
"herokuapp"
"internal"
"irc_pass"
"JEKYLL_GITHUB_TOKEN"
"key"
"keyPassword"
"ldap_password"
"ldap_username"
"login"
"mailchimp"
"mailgun"
"master_key"
"mydotfiles"
"mysql"
"node_env"
"npmrc _auth"
"oauth_token"
"pass"
"passwd"
"password"
"passwords"
"pem private"
"preprod"
"private_key"
"prod"
"pwd"
"pwds"
"rds.amazonaws.com password"
"redis_password"
"root_password"
"secret"
"secret.password"
"secret_access_key"
"secret_key"
"secret_token"
"secrets"
"secure"
"security_credentials"
"send.keys"
"send_keys"
"sendkeys"
"SF_USERNAME salesforce"
"sf_username"
"site.com" FIREBASE_API_JSON=
"site.com" vim_settings.xml
"slack_api"
"slack_token"
"sql_password"
"ssh"
"ssh2_auth_password"
"sshpass"
"staging"
"stg"
"storePassword"
"stripe"
"swagger"
"testuser"
"token"
"x-api-key"
"xoxb "
"xoxp"
[WFClient] Password= extension:ica
access_key
bucket_password
dbpassword
dbuser
extension:avastlic "support.avast.com"
extension:bat
extension:cfg
extension:env
extension:exs
extension:ini
extension:json api.forecast.io
extension:json googleusercontent client_secret
extension:json mongolab.com
extension:pem
extension:pem private
extension:ppk
extension:ppk private
extension:properties
extension:sh
extension:sls
extension:sql
extension:sql mysql dump
extension:sql mysql dump password
extension:yaml mongolab.com
extension:zsh
filename:.bash_history
filename:.bash_history DOMAIN-NAME
filename:.bash_profile aws
filename:.bashrc mailchimp
filename:.bashrc password
filename:.cshrc
filename:.dockercfg auth
filename:.env DB_USERNAME NOT homestead
filename:.env MAIL_HOST=smtp.gmail.com
filename:.esmtprc password
filename:.ftpconfig
filename:.git-credentials
filename:.history
filename:.htpasswd
filename:.netrc password
filename:.npmrc _auth
filename:.pgpass
filename:.remote-sync.json
filename:.s3cfg
filename:.sh_history
filename:.tugboat NOT _tugboat
filename:_netrc password
filename:apikey
filename:bash
filename:bash_history
filename:bash_profile
filename:bashrc
filename:beanstalkd.yml
filename:CCCam.cfg
filename:composer.json
filename:config
filename:config irc_pass
filename:config.json auths
filename:config.php dbpasswd
filename:configuration.php JConfig password
filename:connections
filename:connections.xml
filename:constants
filename:credentials
filename:credentials aws_access_key_id
filename:cshrc
filename:database
filename:dbeaver-data-sources.xml
filename:deployment-config.json
filename:dhcpd.conf
filename:dockercfg
filename:environment
filename:express.conf
filename:express.conf path:.openshift
filename:filezilla.xml
filename:filezilla.xml Pass
filename:git-credentials
filename:gitconfig
filename:global
filename:history
filename:htpasswd
filename:hub oauth_token
filename:id_dsa
filename:id_rsa
filename:id_rsa or filename:id_dsa
filename:idea14.key
filename:known_hosts
filename:logins.json
filename:makefile
filename:master.key path:config
filename:netrc
filename:npmrc
filename:pass
filename:passwd path:etc
filename:pgpass
filename:prod.exs
filename:prod.exs NOT prod.secret.exs
filename:prod.secret.exs
filename:proftpdpasswd
filename:recentservers.xml
filename:recentservers.xml Pass
filename:robomongo.json
filename:s3cfg
filename:secrets.yml password
filename:server.cfg
filename:server.cfg rcon password
filename:settings
filename:settings.py SECRET_KEY
filename:sftp-config.json
filename:sftp-config.json password
filename:sftp.json path:.vscode
filename:shadow
filename:shadow path:etc
filename:spec
filename:sshd_config
filename:token
filename:tugboat
filename:ventrilo_srv.ini
filename:WebServers.xml
filename:wp-config
filename:wp-config.php
filename:zhrc
HEROKU_API_KEY language:json
HEROKU_API_KEY language:shell
HOMEBREW_GITHUB_API_TOKEN language:shell
jsforce extension:js conn.login
language:yaml -filename:travis
msg nickserv identify filename:config
org:Target "AWS_ACCESS_KEY_ID"
org:Target "list_aws_accounts"
org:Target "aws_access_key"
org:Target "aws_secret_key"
org:Target "bucket_name"
org:Target "S3_ACCESS_KEY_ID"
org:Target "S3_BUCKET"
org:Target "S3_ENDPOINT"
org:Target "S3_SECRET_ACCESS_KEY"
password
path:sites databases password
private -language:java
PT_TOKEN language:bash
redis_password
root_password
secret_access_key
SECRET_KEY_BASE=
shodan_api_key language:python
WORDPRESS_DB_PASSWORD=
xoxp OR xoxb OR xoxa
s3.yml
.exs
beanstalkd.yml
deploy.rake
.sls
AWS_SECRET_ACCESS_KEY
API KEY
API SECRET
API TOKEN
ROOT PASSWORD
ADMIN PASSWORD
GCP SECRET
AWS SECRET
"private" extension:pgp

Wide Source Code Search

์ฐธ๊ณ ์ž๋ฃŒ

  • ๊ณต๊ฐœ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ๋น„๋ฐ€์„ ์˜ฌ๋ฆฌ์ง€ ์•Š๊ธฐ (GitHub Blog, Feb 29, 2024): https://github.blog/news-insights/product-news/keeping-secrets-out-of-public-repositories/
  • TruffleHog v3 โ€“ leaked credentials๋ฅผ ์ฐพ๊ณ , ๊ฒ€์ฆํ•˜๋ฉฐ ๋ถ„์„ํ•ฉ๋‹ˆ๋‹ค: https://github.com/trufflesecurity/trufflehog

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ