Git (Github)

GitHub can be a wealth of information.


  • Things to look for
    • Hostnames
    • Credentials
      • SSL Keys
      • SSH Keys
      • Tokens
    • Application Configs

General Strategy

  • Find official repos
    • Look at history for deleted resources
  • Find committers
  • Look at other repos for leaks


  • Gitrob – Look for keys and sensitive files in repositories and present the results as a web interface.
  • truffleHog – digs through commit history and branches looking for secrets checked in
  • git-all-secrets – search through multiple git repos and run scanners against them
  • github dorks – search github for interesting information

Git grep