GitHub Dorks
September 15, 2026 ยท View on GitHub
GitHub Dorks
Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is supposed to be useful for assessing security and performing pen-testing of systems.
GitHub Dork Search Tool
github-dorks is a Python command-line tool that searches a repository or an
organization/user's repositories using the queries in a dorks file.
Installation
This tool uses github3.py to talk with GitHub Search API.
Clone this repository and run:
pip install .
Docker Installation
You can also run github-dorks using Docker for a consistent environment:
# Build the Docker image
docker build -t github-dorks .
# Run with a GitHub token (recommended)
docker run -e GH_TOKEN=your_github_token github-dorks -u someuser
# Run with username/password
docker run -e GH_USER=your_username -e GH_PWD=your_password github-dorks -u someuser
# Save results to a CSV file
docker run -v $(pwd)/output:/app/output -e GH_TOKEN=your_github_token github-dorks -u someuser -o /app/output/results.csv
Usage
GH_USER - Environment variable to specify Github user
GH_PWD - Environment variable to specify a password
GH_TOKEN - Environment variable to specify Github token
GH_URL - Environment variable to specify GitHub Enterprise base URL
Some example usages are listed below:
github-dorks -r techgaun/github-dorks # search a single repo
github-dorks -u techgaun # search all repos of a user
github-dorks -u dev-nepal # search all repos of an organization
GH_USER=techgaun GH_PWD=<mypass> github-dorks -u dev-nepal # search as authenticated user
GH_TOKEN=<github_token> github-dorks -u dev-nepal # search using auth token
GH_URL=https://github.example.com github-dorks -u dev-nepal # search a GitHub Enterprise instance
github-dorks -r techgaun/github-dorks --max-retries 5 # retry recoverable failures up to five times
github-dorks -r techgaun/github-dorks --format json # stream JSON to stdout
github-dorks -u dev-nepal --format jsonl -o results.jsonl # write newline-delimited JSON
github-dorks -u dev-nepal --format csv -o results.csv --force # explicitly replace an existing file
github-dorks --list-categories # list bundled dictionaries
github-dorks -r techgaun/github-dorks -c cloud -c devops # scan selected categories
github-dorks --local ./cloned-repo -c ai -c identity # scan a local working tree
github-dorks --local . --format jsonl -o local-results.jsonl # save offline results
The legacy python github-dork.py ... invocation remains available for
compatibility. The package can also run as python -m github_dorks ....
Each scan ends with a summary of queries, matches, failures, retries, and
elapsed time. The command exits with status 0 after a complete scan, 2 when
one or more queries failed, and 1 for fatal configuration, file, or
authentication errors.
Local scans do not require GitHub credentials or network access. In a Git
working tree, the scanner checks tracked files and non-ignored untracked files;
elsewhere it recursively checks files while excluding .git. It supports the
dictionary syntax used by this project, including quoted text, OR, NOT, and
the filename:, path:, extension:, and common language: qualifiers.
Binary files and files larger than 1 MB are skipped by default. Override that
limit in bytes with --max-file-size.
Supported result formats are text, csv, json, and jsonl. Text is the
default for terminal output; using -o/--output without --format preserves
the historical CSV default. Existing files are protected unless --force is
provided. Use --quiet to suppress progress and summaries, or --verbose to
print every query as it runs. Structured stdout remains machine-readable because
status messages are sent to stderr.
The bundled dictionary is split into ai, cloud, databases, devops,
frameworks, identity, observability, private-keys, saas, and system
categories. Repeat -c/--category to combine categories. With no category or
custom --dork file, the command uses the backward-compatible
github-dorks.txt aggregate. That aggregate is generated from the category
files with python scripts/build-dorks.py.
Development
Run the dependency-free unit test suite with:
python -m unittest discover -s tests -v
The CI test matrix covers Python 3.10 through 3.13.
Limitations
- Authenticated requests receive higher rate limits. Searches may pause until GitHub resets the search limit.
- Large category combinations can take time because GitHub applies a separate search rate limit.
- Offline scanning inspects the current working tree only; Git history scanning is not yet supported.
Contribution
Please consider contributing dorks that can reveal potentially sensitive information on GitHub. Documented sources for newer credential families are maintained in docs/dork-sources.md.
List of Dorks
The canonical dictionaries are the categorized files. The generated github-dorks.txt file contains every category for backward compatibility. The table below provides descriptions for many established patterns; newer credential families and their vendor references are tracked in docs/dork-sources.md. Many dorks can be modified to make the search more specific or generic. You can see more options here.
| Dork | Description |
|---|---|
| filename:.npmrc _auth | npm registry authentication data |
| filename:.dockercfg auth | docker registry authentication data |
| extension:pem private | private keys |
| extension:ppk private | puttygen private keys |
| filename:id_rsa or filename:id_dsa | private ssh keys |
| extension:sql mysql dump | mysql dump |
| extension:sql mysql dump password | mysql dump look for password; you can try varieties |
| filename:credentials aws_access_key_id | might return false negatives with dummy values |
| filename:.s3cfg | might return false negatives with dummy values |
| filename:wp-config.php | wordpress config files |
| filename:.htpasswd | htpasswd files |
| filename:.env DB_USERNAME NOT homestead | laravel .env (CI, various ruby based frameworks too) |
| filename:.env MAIL_HOST=smtp.gmail.com | gmail smtp configuration (try different smtp services too) |
| filename:.git-credentials | git credentials store, add NOT username for more valid results |
| PT_TOKEN language:bash | pivotaltracker tokens |
| filename:.bashrc password | search for passwords, etc. in .bashrc (try with .bash_profile too) |
| filename:.bashrc mailchimp | variation of above (try more variations) |
| filename:.bash_profile aws | aws access and secret keys |
| rds.amazonaws.com password | Amazon RDS possible credentials |
| extension:json api.forecast.io | try variations, find api keys/secrets |
| extension:json mongolab.com | mongolab credentials in json configs |
| extension:yaml mongolab.com | mongolab credentials in yaml configs (try with yml) |
| jsforce extension:js conn.login | possible salesforce credentials in nodejs projects |
| SF_USERNAME salesforce | possible salesforce credentials |
| filename:.tugboat NOT _tugboat | Digital Ocean tugboat config |
| HEROKU_API_KEY language:shell | Heroku api keys |
| HEROKU_API_KEY language:json | Heroku api keys in json files |
| filename:.netrc password | netrc that possibly holds sensitive credentials |
| filename:_netrc password | netrc that possibly holds sensitive credentials |
| filename:hub oauth_token | hub config that stores github tokens |
| filename:robomongo.json | mongodb credentials file used by robomongo |
| filename:filezilla.xml Pass | filezilla config file with possible user/pass to ftp |
| filename:recentservers.xml Pass | filezilla config file with possible user/pass to ftp |
| filename:config.json auths | docker registry authentication data |
| filename:idea14.key | IntelliJ Idea 14 key, try variations for other versions |
| filename:config irc_pass | possible IRC config |
| filename:connections.xml | possible db connections configuration, try variations to be specific |
| filename:express.conf path:.openshift | openshift config, only email and server thou |
| filename:.pgpass | PostgreSQL file which can contain passwords |
| filename:proftpdpasswd | Usernames and passwords of proftpd created by cpanel |
| filename:ventrilo_srv.ini | Ventrilo configuration |
| [WFClient] Password= extension:ica | WinFrame-Client infos needed by users to connect toCitrix Application Servers |
| filename:server.cfg rcon password | Counter Strike RCON Passwords |
| JEKYLL_GITHUB_TOKEN | Github tokens used for jekyll |
| filename:.bash_history | Bash history file |
| filename:.cshrc | RC file for csh shell |
| filename:.history | history file (often used by many tools) |
| filename:.sh_history | korn shell history |
| filename:sshd_config | OpenSSH server config |
| filename:dhcpd.conf | DHCP service config |
| filename:prod.exs NOT prod.secret.exs | Phoenix prod configuration file |
| filename:prod.secret.exs | Phoenix prod secret |
| filename:configuration.php JConfig password | Joomla configuration file |
| filename:config.php dbpasswd | PHP application database password (e.g., phpBB forum software) |
| path:sites databases password | Drupal website database credentials |
| shodan_api_key language:python | Shodan API keys (try other languages too) |
| filename:shadow path:etc | Contains encrypted passwords and account information of new unix systems |
| filename:passwd path:etc | Contains user account information including encrypted passwords of traditional unix systems |
| extension:avastlic "support.avast.com" | Contains license keys for Avast! Antivirus |
| filename:dbeaver-data-sources.xml | DBeaver config containing MySQL Credentials |
| filename:.esmtprc password | esmtp configuration |
| extension:json googleusercontent client_secret | OAuth credentials for accessing Google APIs |
| HOMEBREW_GITHUB_API_TOKEN language:shell | Github token usually set by homebrew users |
| xoxp OR xoxb | Slack bot and private tokens |
| .mlab.com password | MLAB Hosted MongoDB Credentials |
| filename:logins.json | Firefox saved password collection (key3.db usually in same repo) |
| filename:CCCam.cfg | CCCam Server config file |
| msg nickserv identify filename:config | Possible IRC login passwords |
| filename:settings.py SECRET_KEY | Django secret keys (usually allows for session hijacking, RCE, etc) |
| filename:secrets.yml password | Usernames/passwords, Rails applications |
| filename:master.key path:config | Rails master key (used for decrypting credentials.yml.enc for Rails 5.2+) |
| filename:deployment-config.json | Created by sftp-deployment for Atom, contains server details and credentials |
| filename:.ftpconfig | Created by remote-ssh for Atom, contains SFTP/SSH server details and credentials |
| filename:.remote-sync.json | Created by remote-sync for Atom, contains FTP and/or SCP/SFTP/SSH server details and credentials |
| filename:sftp.json path:.vscode | Created by vscode-sftp for VSCode, contains SFTP/SSH server details and credentails |
| filename:sftp-config.json | Created by SFTP for Sublime Text, contains FTP/FTPS or SFTP/SSH server details and credentials |
| filename:WebServers.xml | Created by Jetbrains IDEs, contains webserver credentials with encoded passwords (not encrypted!) |
| "api_hash" "api_id" | Telegram API token |
| "https://hooks.slack.com/services/" | Slack services URL often have secret API token as a suffix |
| filename:github-recovery-codes.txt | GitHub recovery key |
| filename:gitlab-recovery-codes.txt | GitLab recovery key |
| filename:discord_backup_codes.txt | Discord recovery key |
| extension:yaml cloud.redislabs.com | Redis credentials provided by Redis Labs found in a YAML file |
| extension:json cloud.redislabs.com | Redis credentials provided by Redis Labs found in a JSON file |