From 95cfd4b83a4a9f1de69dd5f055adf6d8b928b064 Mon Sep 17 00:00:00 2001 From: techgaun Date: Fri, 28 Aug 2026 17:07:29 -0500 Subject: [PATCH] feat: add modern credential dorks --- README.md | 9 ++++++- docs/dork-sources.md | 36 +++++++++++++++++++++++++++ github-dorks.txt | 51 +++++++++++++++++++++++++++++++++++++++ tests/test_github_dork.py | 33 +++++++++++++++++++++++++ 4 files changed, 128 insertions(+), 1 deletion(-) create mode 100644 docs/dork-sources.md diff --git a/README.md b/README.md index a9f2f74..29f6093 100644 --- a/README.md +++ b/README.md @@ -80,10 +80,17 @@ The CI test matrix covers Python 3.10 through 3.13. ### Contribution Please consider contributing dorks that can reveal potentially sensitive information on Github. +Documented sources for newer credential families are maintained in +[docs/dork-sources.md](docs/dork-sources.md). ### List of Dorks -I am not categorizing at the moment. Instead, I am going to just the list of dorks with a description. Many of the dorks can be modified to make the search more specific or generic. You can see more options [here](https://github.com/search#search_cheatsheet_pane). +The canonical, categorized dictionary is [github-dorks.txt](github-dorks.txt). +The table below provides descriptions for many established patterns; newer +credential families and their vendor references are tracked in +[docs/dork-sources.md](docs/dork-sources.md). Many dorks can be modified to make +the search more specific or generic. You can see more options +[here](https://docs.github.com/en/search-github/github-code-search/understanding-github-code-search-syntax). Dork | Description ------------------------------------------------|-------------------------------------------------------------------------- diff --git a/docs/dork-sources.md b/docs/dork-sources.md new file mode 100644 index 0000000..00c4b1c --- /dev/null +++ b/docs/dork-sources.md @@ -0,0 +1,36 @@ +# Dork source references + +The primary `github-dorks.txt` dictionary favors documented token prefixes and +canonical environment-variable names. Prefixes generally produce stronger +signals; variable-name searches also catch providers that do not guarantee a +stable public token format. + +These references support the modern credential families added to the +dictionary. They are not exhaustive, and a match still requires manual review. + +## Git hosting and package registries + +- [GitHub token formats](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-authentication-to-github) +- [GitLab token prefixes](https://docs.gitlab.com/security/tokens/#token-prefixes) +- [npm access tokens](https://docs.npmjs.com/about-access-tokens/) +- [PyPI token format](https://docs.pypi.org/trusted-publishers/internals/) + +## AI providers + +- [OpenAI API key setup](https://platform.openai.com/docs/quickstart) +- [Claude API authentication](https://platform.claude.com/docs/en/api/overview#authentication) +- [Hugging Face user access tokens](https://huggingface.co/docs/hub/security-tokens) + +## Cloud and infrastructure + +- [HCP Terraform CLI credentials](https://developer.hashicorp.com/terraform/cli/config/config-file#credentials) +- [Cloudflare API tokens](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) +- [DigitalOcean API tokens](https://docs.digitalocean.com/reference/api/create-personal-access-token/) +- [Pulumi access tokens](https://www.pulumi.com/docs/administration/access-identity/access-tokens/) +- [Vercel access tokens](https://vercel.com/docs/rest-api/reference/welcome#creating-an-access-token) +- [Supabase environment variables](https://supabase.com/docs/guides/functions/secrets) +- [Sentry authentication tokens](https://docs.sentry.io/api/auth/) + +## General secret formats + +- [GitHub-supported secret patterns](https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns) diff --git a/github-dorks.txt b/github-dorks.txt index c5625a6..3e5fd75 100644 --- a/github-dorks.txt +++ b/github-dorks.txt @@ -88,3 +88,54 @@ filename:discord_backup_codes.txt extension:yaml cloud.redislabs.com extension:json cloud.redislabs.com DATADOG_API_KEY language:shell + +# Git hosting and CI/CD tokens +"github_pat_" +"ghp_" +"gho_" OR "ghu_" OR "ghs_" OR "ghr_" +"glpat-" +"gloas-" OR "gldt-" +"glrt-" OR "glrtr-" OR "glcbt-" OR "glptt-" + +# Package registry tokens +filename:.npmrc "_authToken=" +"pypi-" filename:.pypirc +"NUGET_API_KEY" path:.env +"GEM_HOST_API_KEY" path:.env + +# AI and machine learning provider credentials +"OPENAI_API_KEY" path:.env +"ANTHROPIC_API_KEY" path:.env +"sk-ant-" +"HF_TOKEN" path:.env +"hf_" filename:token path:huggingface + +# Cloud, infrastructure, and deployment credentials +"CLOUDFLARE_API_TOKEN" path:.env +"DIGITALOCEAN_ACCESS_TOKEN" path:.env +"dop_v1_" +"PULUMI_ACCESS_TOKEN" path:.env +"TFE_TOKEN" path:.env +"atlasv1" filename:credentials.tfrc.json +"VERCEL_TOKEN" path:.env +"SUPABASE_SERVICE_ROLE_KEY" path:.env +"SENTRY_AUTH_TOKEN" path:.env +"sntrys_" + +# Payment and communications credentials +"sk_live_" OR "rk_live_" +"SENDGRID_API_KEY" path:.env +"TWILIO_AUTH_TOKEN" path:.env +"SLACK_BOT_TOKEN" path:.env +"DISCORD_BOT_TOKEN" path:.env + +# Database connection strings and service accounts +"mongodb+srv://" password +"postgres://" password +filename:service-account.json "private_key_id" "private_key" +"GOOGLE_PRIVATE_KEY" path:.env + +# Modern private key formats +"-----BEGIN OPENSSH PRIVATE KEY-----" +"-----BEGIN PRIVATE KEY-----" +"AGE-SECRET-KEY-1" diff --git a/tests/test_github_dork.py b/tests/test_github_dork.py index 2127a7e..2cbc79b 100644 --- a/tests/test_github_dork.py +++ b/tests/test_github_dork.py @@ -90,5 +90,38 @@ def test_rejects_missing_dorks_file_with_clear_error(self): github_dork.search(gh_dorks_file='/does/not/exist') +class DorkDictionaryTests(unittest.TestCase): + @classmethod + def setUpClass(cls): + dictionary = Path(__file__).parents[1] / 'github-dorks.txt' + cls.lines = dictionary.read_text(encoding='utf-8').splitlines() + cls.dorks = [ + line for line in cls.lines + if line and not line.startswith(('#', ';')) + ] + + def test_has_no_duplicate_dorks(self): + duplicates = sorted({dork for dork in self.dorks if self.dorks.count(dork) > 1}) + self.assertEqual(duplicates, []) + + def test_has_no_surrounding_whitespace(self): + untrimmed = [line for line in self.lines if line != line.strip()] + self.assertEqual(untrimmed, []) + + def test_has_balanced_quotes(self): + malformed = [dork for dork in self.dorks if dork.count('"') % 2] + self.assertEqual(malformed, []) + + def test_contains_modern_credential_families(self): + dictionary = '\n'.join(self.dorks) + for marker in ( + 'github_pat_', 'glpat-', 'pypi-', 'OPENAI_API_KEY', + 'ANTHROPIC_API_KEY', 'HF_TOKEN', 'CLOUDFLARE_API_TOKEN', + 'SUPABASE_SERVICE_ROLE_KEY', 'sk_live_', + ): + with self.subTest(marker=marker): + self.assertIn(marker, dictionary) + + if __name__ == '__main__': unittest.main()