> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/passive-reconnaissance-techniques/github-dork.md). # Github Dork **GitHub Dorking**, which is the process of searching for sensitive information in public GitHub repositories using specific search queries (dorks). It helps to identify exposed credentials, API keys, secrets, and other sensitive information that may have been unintentionally committed to GitHub. #### GitHub can reveal: * Exposed API keys, credentials, and sensitive data. * Developer identities and email addresses. * Organization structure and internal repositories. * Potential security vulnerabilities in source code. ### Common Used Dokrs List #### **API Keys & Tokens** | **Dork Query** | **Description** | | ----------------- | ------------------------------------ | | `"api_key"` | Generic API key search. | | `"apiToken"` | Looks for API tokens. | | `"access_token"` | Searches for access tokens. | | `"auth_token"` | Finds authentication tokens. | | `"bearer_token"` | Searches for bearer tokens. | | `"client_secret"` | Searches for client secrets in APIs. | | `"consumer_key"` | Looks for OAuth consumer keys. | | `"private_token"` | Finds private API tokens. | | `"apikey"` | Searches for API key variations. | | `"secret_key"` | Finds secret keys. | *** #### **Database Files & Credentials** | **Dork Query** | **Description** | | ------------------ | ------------------------------------------ | | `extension:sql` | Searches for SQL dump files. | | `extension:db` | Finds database files. | | `extension:sqlite` | Searches for SQLite database files. | | `"mysql_connect"` | Finds MySQL connection strings. | | `"mysql_pconnect"` | Searches for persistent MySQL connections. | | `"pg_connect"` | Finds PostgreSQL connection strings. | | `"db_password"` | Looks for database passwords. | | `"db_username"` | Searches for database usernames. | | `"database_url"` | Searches for database connection URLs. | | `"mongodb+srv://"` | Finds MongoDB connection strings. | *** #### **Configuration & Environment Files** | **Dork Query** | **Description** | | --------------------------------------------- | -------------------------------------- | | `filename:.env` | Finds `.env` files containing secrets. | | `extension:env` | Searches for environment files. | | `filename:.config` | Searches for configuration files. | | `extension:conf` | Looks for config files. | | `extension:cnf` | Searches for MySQL `.cnf` files. | | `filename:settings.py` | Finds Django settings files. | | `filename:config.json` | Looks for JSON config files. | | `filename:config.yaml OR filename:config.yml` | Searches for YAML config files. | | `filename:wp-config.php` | Finds WordPress config files. | | `filename:application.properties` | Searches for Java properties files. | *** #### **Sensitive Log Files** | **Dork Query** | **Description** | | ------------------------- | --------------------------- | | `extension:log` | Generic log file search. | | `filename:debug.log` | Searches for debug logs. | | `filename:access.log` | Finds access logs. | | `filename:error.log` | Looks for error logs. | | `filename:system.log` | Searches for system logs. | | `filename:exceptions.log` | Finds exception logs. | | `filename:audit.log` | Looks for audit logs. | | `filename:out.log` | Searches for output logs. | | `filename:server.log` | Finds server logs. | | `filename:app.log` | Looks for application logs. | *** #### **Private Keys & SSH Credentials** | **Dork Query** | **Description** | | ----------------------------- | ---------------------------------- | | `extension:pem` | Searches for PEM private keys. | | `extension:ppk` | Finds PuTTY private keys. | | `"BEGIN RSA PRIVATE KEY"` | Searches for RSA private keys. | | `"BEGIN DSA PRIVATE KEY"` | Looks for DSA private keys. | | `"BEGIN OPENSSH PRIVATE KEY"` | Searches for OpenSSH private keys. | | `"BEGIN EC PRIVATE KEY"` | Finds elliptic curve private keys. | | `"id_rsa"` | Searches for SSH private keys. | | `"id_dsa"` | Finds SSH DSA keys. | | `"ssh_passphrase"` | Looks for SSH passphrases. | | `"ssh_private_key"` | Finds SSH private keys. | *** #### **AWS & Cloud Credentials** | **Dork Query** | **Description** | | ------------------------- | ----------------------------------------- | | `"AWS_ACCESS_KEY_ID"` | Searches for AWS access keys. | | `"AWS_SECRET_ACCESS_KEY"` | Finds AWS secret keys. | | `"s3_secret_key"` | Looks for S3 secret keys. | | `"amazonaws.com"` | Finds AWS-related URLs. | | `"s3.amazonaws.com"` | Searches for exposed S3 buckets. | | `"google_api_key"` | Finds Google API keys. | | `"firebase_database_url"` | Looks for Firebase database URLs. | | `"azure_storage_key"` | Searches for Azure storage keys. | | `"gcp_private_key"` | Finds Google Cloud Platform private keys. | | `"cloudinary://"` | Searches for Cloudinary API keys. | *** #### **Backup & Archive Files** | **Dork Query** | **Description** | | ------------------ | ------------------------------------ | | `extension:bak` | Searches for backup files. | | `extension:backup` | Finds generic backup files. | | `extension:old` | Searches for old version files. | | `extension:zip` | Looks for ZIP archives. | | `extension:rar` | Searches for RAR archives. | | `extension:tar` | Finds TAR files. | | `extension:7z` | Searches for 7z compressed files. | | `extension:gz` | Looks for Gzip archives. | | `extension:sql.gz` | Searches for compressed SQL backups. | | `extension:dump` | Finds database dump files. | *** #### **Email Addresses & User Information** | **Dork Query** | **Description** | | -------------------- | ----------------------------------- | | `"@gmail.com"` | Finds Gmail addresses. | | `"@yahoo.com"` | Searches for Yahoo emails. | | `"@outlook.com"` | Looks for Outlook emails. | | `"@example.com"` | Finds example domain emails. | | `"user@example.com"` | Searches for specific user emails. | | `"email_password"` | Looks for email credentials. | | `"email_user"` | Searches for email usernames. | | `"smtp_password"` | Finds SMTP passwords. | | `"smtp_user"` | Searches for SMTP usernames. | | `"mail_password"` | Looks for mail service credentials. | *** #### **SQL Queries & Injection Points** | **Dork Query** | **Description** | | ------------------- | -------------------------------------- | | `"SELECT * FROM"` | Searches for SQL queries. | | `"INSERT INTO"` | Finds SQL insert statements. | | `"DROP TABLE"` | Searches for destructive SQL commands. | | `"ALTER TABLE"` | Finds SQL table alterations. | | `"CREATE DATABASE"` | Looks for database creation commands. | | `"DELETE FROM"` | Searches for SQL delete statements. | | `"WHERE username="` | Finds SQL conditions. | | `"UNION SELECT"` | Searches for SQL injection attempts. | | `"mysql_query"` | Looks for MySQL queries in code. | | `"pg_query"` | Searches for PostgreSQL queries. | *** #### **Miscellaneous Sensitive Files** | **Dork Query** | **Description** | | ------------------------------ | ------------------------------------------------ | | `filename:.bash_history` | Searches for Bash history files. | | `filename:.zsh_history` | Finds Zsh history files. | | `filename:.git-credentials` | Searches for Git credentials. | | `filename:.htpasswd` | Looks for `.htpasswd` files. | | `filename:.htaccess` | Finds `.htaccess` files. | | `filename:.docker/config.json` | Searches for Docker config files. | | `filename:.npmrc` | Finds npm credentials. | | `filename:.yarnrc` | Searches for Yarn credentials. | | `filename:id_rsa` | Finds SSH private keys. | | `filename:netrc` | Looks for `.netrc` files containing credentials. | {% embed url="" %}