github-secret-hunting

1# GitHub Secret Hunting
2 
3Scan public GitHub repositories for leaked API keys, tokens, passwords, and internal infrastructure details. Developers accidentally push secrets constantly — this skill uses targeted dorking, automated scanning tools, and real-time monitoring to find credentials before the developer notices and revokes them.
4 
5## When to Use
6 
7- Target has public repositories under an organization account.
8- JS bundle analysis reveals internal service names — search GitHub for related config files.
9- Need to find valid API keys for cloud services, payment gateways, or third-party integrations.
10- The target uses CI/CD systems that may leak tokens in build logs or workflow files.
11- Want real-time monitoring for new secret leaks from the target org.
12 
13## Prerequisites
14 
15- `terminal` with python3, curl, git.
16- GitHub Personal Access Token (only `public_repo` scope needed).
17- Tool dependencies: TruffleHog, GitDorker, gitleaks.
18 
19## How to Run
20 
21```bash
22# Basic GitHub code search for sensitive patterns in target repos
23echo "target.com" | while read domain; do
24  curl --max-time 30 --connect-timeout 10 -s -H "Authorization: token $GITHUB_TOKEN" \
25    "https://api.github.com/search/code?q=$domain+filename:.env" \
26    | jq '.items[]?.html_url'
27done
28```
29 
30## Quick Detection
31 
32```bash
33# Basic GitHub code search for sensitive patterns in target repos
34echo "target.com" | while read domain; do
35  curl --max-time 30 --connect-timeout 10 -s -H "Authorization: token $GITHUB_TOKEN" \
36…