github-secret-hunting

What problem does it solve?

Developers frequently accidentally push sensitive credentials such as API keys, access tokens, passwords, and internal infrastructure details to public GitHub repositories, creating a significant security risk if these secrets are discovered and exploited by malicious actors before they are revoked.

Core Features & Use Cases

• Targeted GitHub Dorking: Use GitDorker with pre-built dork lists to search for sensitive files like .env, configuration files, and CI/CD workflow files across target organization repositories.
• Deep Historical Secret Scanning: Leverage TruffleHog to scan entire GitHub organizations or individual repositories, including deleted commit history, to find verified active secrets.
• Real-Time Leak Monitoring: Use shhgit to monitor for new secret leaks from target organizations as they are pushed to public repositories.
• Credential Verification: Validate discovered secrets with minimal API calls to confirm they are still active and assess their access level. Use case: For example, during a penetration test of a target that hosts public code on GitHub, use this skill to identify valid AWS access keys or GitHub personal access tokens exposed in their repositories to evaluate credential exposure risk.

Quick Start

Use the github-secret-hunting skill to scan the public GitHub repositories of target.com for leaked API keys, tokens, and hardcoded credentials, then verify which of the found secrets are still active.