# GH Dork | Github Dorking Tool

**URL:** <https://onehack.st/t/gh-dork-github-dorking-tool/213451>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, data-recovery\
**Created:** [January 31, 2022, 10:13am UTC](https://onehack.st/t/gh-dork-github-dorking-tool/213451 "2022-01-31T10:13:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [January 31, 2022, 10:13am UTC](https://onehack.st/t/gh-dork-github-dorking-tool/213451/1 "2022-01-31T10:13:44Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/2/d/2dc73c5ce6f4f91facff4ddf44a683701579a6f7.png)

Supply a list of dorks and, optionally, one of the following:

- a user (`-u`)
- a file with a list of users (`-uf`)
- an organization (`-org`)
- a file with a list of organizations (`-of`)
- a repo (`-r`)

You can also pass:

- an output directory to store results (`-o`)
- a filename to store valid items, if your users or org file may contain nonexistent users/orgs (`-vif`)

All input files (dorks, users, or orgs) should be newline-separated.

## Usage

Clone the repository, then run `pip install -r requirements.txt`

The only required parameter is the dorks file (`-d`). See [techguan’s github-dorks.txt](https://github.com/techgaun/github-dorks/blob/master/github-dorks.txt) for ideas.

If an output directory is specified, a file will be created for each dork in the dorks list, and results will be saved there as well as printed. **Only use an empty/nonexistent directory or it will be cleared and its contents replaced.**

If your users or orgs files haven’t already been filtered to remove non-existent users/orgs or those without any public code, it’s highly recommended that you pass in a `--valid-items-filename` (`-vif`). This will filter out any invalid users/orgs when searching for the first dork, and avoid searching against them for subsequent dorks. The output file can also then be used as the input users/orgs file to speed up later script runs.

Example usage:

```auto
python gh-dork.py -d dorks.txt # Basic usage
python gh-dork.py -d dorks.txt -u molly # Search repos of a specific user
python gh-dork.py -d dorks.txt -uf users.txt # Search repos of all users in the list
python gh-dork.py -d dorks.txt -uf users.txt -vif valid_users.txt # Search repos of all users in the list, filtering out nonexistent users
python gh-dork.py -d dorks.txt -org github # Search repos of a specific organization
python gh-dork.py -d dorks.txt -of orgs.txt # Search repos of all orgs in the list
python gh-dork.py -d dorks.txt -of orgs.txt -vif valid_orgs.txt # Search repos of all orgs in the list, filtering out nonexistent orgs
python gh-dork.py -d dorks.txt -r molly/gh-dork # Search the specified repo
python gh-dork.py -d dorks.txt -o results # Store results in files in the results/ directory, *overwriting any directory contents*

```

## Authentication

Authentication is done with environment variables. You can authenticate with a Github private access token (`GH_TOKEN`), or username and password (`GH_USER` and `GH_PASS`). If you have two-factor authentication enabled, you will be prompted for a two-factor code.

You can also pass a Github Enterprise base URL (`GH_URL`) to search against that Github instance; if omitted, this will run against [github.com](http://github.com).

If no credentials are provided or if credentials are invalid, the script will still run, but will be limited by the [much lower rate limits](https://docs.github.com/en/rest/reference/search) for unauthenticated users.

## Credits

Loosely based on [techgaun/github-dorks](https://github.com/techgaun/github-dorks).

## GitHub:

> **[GitHub - molly/gh-dork: Github dorking tool](https://github.com/molly/gh-dork)**
>
> Github dorking tool