Kali Linux

Gh-Dork : Github Dorking Tool

Gh-Dork is a Github Dorking Tool. Supply a list of dorks and, optionally, one of the following:

  • a user (-u)
  • a file with a list of users (-uf)
  • an organization (-org)
  • a file with a list of organizations (-of)
  • a repo (-r)

You can also pass:

  • an output directory to store results (-o)
  • a filename to store valid items, if your users or org file may contain nonexistent users/orgs (-vif)

All input files (dorks, users, or orgs) should be newline-separated.

Usage

Clone the repository, then run pip install -r requirements.txt

The only required parameter is the dorks file (-d). See techguan’s github-dorks.txt for ideas.

If an output directory is specified, a file will be created for each dork in the dorks list, and results will be saved there as well as printed. Only use an empty/nonexistent directory or it will be cleared and its contents replaced.

If your users or orgs files haven’t already been filtered to remove non-existent users/orgs or those without any public code, it’s highly recommended that you pass in a --valid-items-filename (-vif). This will filter out any invalid users/orgs when searching for the first dork, and avoid searching against them for subsequent dorks. The output file can also then be used as the input users/orgs file to speed up later script runs.

Example usage:

python gh-dork.py -d dorks.txt # Basic usage
python gh-dork.py -d dorks.txt -u molly # Search repos of a specific user
python gh-dork.py -d dorks.txt -uf users.txt # Search repos of all users in the list
python gh-dork.py -d dorks.txt -uf users.txt -vif valid_users.txt # Search repos of all users in the list, filtering out nonexistent users
python gh-dork.py -d dorks.txt -org github # Search repos of a specific organization
python gh-dork.py -d dorks.txt -of orgs.txt # Search repos of all orgs in the list
python gh-dork.py -d dorks.txt -of orgs.txt -vif valid_orgs.txt # Search repos of all orgs in the list, filtering out nonexistent orgs
python gh-dork.py -d dorks.txt -r molly/gh-dork # Search the specified repo
python gh-dork.py -d dorks.txt -o results # Store results in files in the results/ directory, overwriting any directory contents

Authentication

Authentication is done with environment variables. You can authenticate with a Github private access token (GH_TOKEN), or username and password (GH_USER and GH_PASS). If you have two-factor authentication enabled, you will be prompted for a two-factor code.

You can also pass a Github Enterprise base URL (GH_URL) to search against that Github instance; if omitted, this will run against github.com.

If no credentials are provided or if credentials are invalid, the script will still run, but will be limited by the much lower rate limits for unauthenticated users.

R K

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

2 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

2 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

2 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

2 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

2 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

2 weeks ago