干货 | 2022年最详细的Github黑客语法总结

admin 2022年7月12日01:10:30评论117 views字数 7176阅读23分55秒阅读模式

搜文件的Github黑客语法

filename:manifest.xmlfilename:travis.ymlfilename:vim_settings.xmlfilename:databasefilename:prod.exs NOT prod.secret.exsfilename:prod.secret.exsfilename:.npmrc _authfilename:.dockercfg authfilename:WebServers.xmlfilename:.bash_historyfilename:sftp-config.jsonfilename:sftp.json path:.vscodefilename:secrets.yml passwordfilename:.esmtprc passwordfilename:passwd path:etcfilename:dbeaver-data-sources.xmlpath:sites databases passwordfilename:config.php dbpasswdfilename:prod.secret.exsfilename:configuration.php JConfig passwordfilename:.sh_historyshodan_api_key language:pythonfilename:shadow path:etcJEKYLL_GITHUB_TOKENfilename:proftpdpasswdfilename:.pgpassfilename:idea14.keyfilename:hub oauth_tokenHEROKU_API_KEY language:jsonHEROKU_API_KEY language:shellSF_USERNAME salesforcefilename:.bash_profile awsextension:json api.forecast.iofilename:.env MAIL_HOST=smtp.gmail.comfilename:wp-config.phpextension:sql mysql dumpfilename:credentials aws_access_key_idfilename:id_rsa or filename:id_dsa

搜代码开发语言的Github黑客语法

language:python usernamelanguage:php usernamelanguage:sql usernamelanguage:html passwordlanguage:perl passwordlanguage:shell usernamelanguage:java apiHOMEBREW_GITHUB_API_TOKEN language:shell

搜相关的Key、API、Toekn、Password的Github黑客语法

api_key“api keys”authorization_bearer:oauthauthauthenticationclient_secretapi_token:“api token”client_idpassworduser_passworduser_passpasscodeclient_secretsecretpassword hashOTPuser auth

搜相关的Username的Github黑客语法

user:name (user:admin)org:name (org:google type:users)in:login ( in:login)in:name ( in:name)fullname:firstname lastname (fullname: )in:email (data in:email)

按照日期搜索相关的Github黑客语法

created:<2012–04–05created:>=2011–06–12created:2016–02–07 location:icelandcreated:2011–04–06..2013–01–14 in:username ...

使用拓展查找相关信息的Github黑客语法

extension:pem privateextension:ppk privateextension:sql mysql dumpextension:sql mysql dump passwordextension:json api.forecast.ioextension:json mongolab.comextension:yaml mongolab.com[WFClient] Password= extension:icaextension:avastlic “support.avast.com”extension:json googleusercontent client_secret ...

最常用的github dorks


filename:config keyfilename:setting keyfilename:env keyfilename:config passwordfilename:setting passwordfilename:env passwordfilename:config secretfilename:setting secretfilename:env secretfilename:config passwortfilename:setting passwortfilename:env passwortfilename:config pwdfilename:setting pwdfilename:env pwd

aws-secret-dorks

filename:credentials aws_access_key_idfilename:.bash_profile awsrds.amazonaws.com passwordfilename:.s3cfgARTIFACTS_AWS_ACCESS_KEY_ID=ARTIFACTS_AWS_SECRET_ACCESS_KEY=AWS-ACCT-ID=AWS-KEY=AWS-SECRETS=AWSAWS.config.accessKeyId=AWS.config.secretAccessKey=AWSACCESSKEYID=AWSCN_ACCESS_KEY_ID=AWSCN_SECRET_ACCESS_KEY=AWSSECRETKEY=AWS_ACCESS=AWS_ACCESS_KEY=AWS_ACCESS_KEY_ID=AWS_CF_DIST_ID=AWS_DEFAULTAWS_DEFAULT_REGION=AWS_S3_BUCKET=AWS_SECRET=AWS_SECRET_ACCESS_KEY=AWS_SECRET_KEY=AWS_SES_ACCESS_KEY_ID=AWS_SES_SECRET_ACCESS_KEY=BUCKETEER_AWS_ACCESS_KEY_ID=BUCKETEER_AWS_SECRET_ACCESS_KEY=SANDBOX_AWS_ACCESS_KEY_ID=SANDBOX_AWS_SECRET_ACCESS_KEY=S3-EXTERNAL-3.AMAZONAWS.COM=S3.AMAZONAWS.COM=filename:.bash_profile awsrds.amazonaws.com password

db dorks

filename:database passwordfilename:database pwfilename:database secret path:sites databases passwordfilename:config dbpasswdfilename:conf databasefilename:.env DB_USERNAME NOT homesteadmysql password

github dorks

filename:config aws_access_key_idfilename:config aws secret.mlab.com passwordHEROKU_API_KEY language:jsonHEROKU_API_KEY language:shellHOMEBREW_GITHUB_API_TOKEN language:shellJEKYLL_GITHUB_TOKENOTPPT_TOKEN language:bashSF_USERNAME salesforce[WFClient] Password= extension:icaapi_keyapi_token:authauthenticationauthorization_bearer:client_idclient_secretextension:dbeaver-data-sources.xmlextension:json api.forecast.ioextension:json cloud.redislabs.comextension:json googleusercontent client_secretextension:json mongolab.comextension:pem privateextension:ppk privateextension:sql mysql dumpextension:sql mysql dump passwordextension:yaml cloud.redislabs.comextension:yaml mongolab.comfilename:.bash_historyfilename:.bash_history <Domain name>filename:.bash_profile awsfilename:.bashrc mailchimpfilename:.bashrc passwordfilename:.cshrcfilename:.dockercfg authfilename:.env DB_USERNAME NOT homesteadfilename:.env MAIL_HOST=smtp.gmail.comfilename:.esmtprc passwordfilename:.ftpconfigfilename:.git-credentialsfilename:.historyfilename:.htpasswdfilename:.netrc passwordfilename:.npmrc _authfilename:.pgpassfilename:.remote-sync.jsonfilename:.s3cfgfilename:.sh_historyfilename:.tugboat NOT _tugboatfilename:CCCam.cfgfilename:WebServers.xmlfilename:_netrc passwordfilename:config irc_passfilename:config.json authsfilename:config dbpasswdfilename:config.php passfilename:config password language:PHPfilename:config password language:XMLfilename:config keyfilename:configuration.php JConfig passwordfilename:connections.xmlfilename:credentials aws_access_key_idfilename:databasefilename:dbeaver-data-sources.xmlfilename:deployment-config.jsonfilename:dhcpd.conffilename:express.conf path:.openshiftfilename:filezilla.xml Passfilename:hub oauth_tokenfilename:id_rsa or filename:id_dsafilename:idea14.keyfilename:jupyter_notebook_config.jsonfilename:logins.jsonfilename:manifest.xmlfilename:master.key path:configfilename:passwd path:etcfilename:prod.exs NOT prod.secret.exsfilename:prod.secret.exsfilename:proftpdpasswdfilename:recentservers.xml Passfilename:robomongo.jsonfilename:secrets.yml passwordfilename:server.cfg rcon passwordfilename:settings.py SECRET_KEYfilename:settings passwordfilename:settings keyfilenane:settings secret filename:sftp-config.jsonfilename:sftp.json path:.vscodefilename:shadow path:etcfilename:sshd_configfilename:travis.ymlfilename:travis.yml passwordfilename:ventrilo_srv.inifilename:vim_settings.xmlfilename:wp-config.phpfullname:firstname lastname (fullname:<name> <surname>)in:email (data in:email)in:login (<username> in:login)in:name (<username> in:name)jsforce extension:js conn.loginlanguage:html passwordlanguage:java apilanguage:perl passwordlanguage:php usernamelanguage:python usernamelanguage:shell usernamelanguage:sql usernamemsg nickserv identify filename:configoauthorg:name (org:google type:users)passcodepasswordpassword hashpath:sites databases passwordrds.amazonaws.com passwordsecretshodan_api_key language:jsonshodan_api_key language:pythonshodan_api_key language:rubyshodan_api_key language:shelluser authuser:name (user:admin)user_passuser_passwordxoxp OR xoxb"Authorization: Bearer""api keys""api token""-----BEGIN PRIVATE KEY-----" NOT test

其他github dorks补充

#email类型
googlemail.comemailaddressmailaddressoutlook.com
#htaccess
htaccess RewriteEngine Onhtaccess General Apache optionshtaccess AddOutputFilterByType htaccess RewriteCond
#拼写错误的类型
filename:conffigfilename:seting usserpaswordpassswordpassowordseccret secredsicretdatebasedatabassesetttingsacccessaccoutacounthtacessmesqlmysqqlbasswordfilename:konfightaccess_file.htaccesshtacces.htacess

推荐相关Github Dork语法字典项目

https://github.com/techgaun/github-dorkshttps://github.com/jcesarstef/ghhdb-Github-Hacking-Databasehttps://github.com/H4CK3RT3CH/github-dorkshttps://github.com/Vaidik-pandya/Github_recon_dorks/blob/main/gitdork.txt

在线Github黑客语法工具

https://mr-koanti.github.io/github.html

干货 | 2022年最详细的Github黑客语法总结

干货 | 2022年最详细的Github黑客语法总结

干货 | 2022年最详细的Github黑客语法总结


推荐阅读:


实战 | 当裸聊诈骗遇到黑客,记一次新型的裸聊诈骗渗透经历


实战 | 记一次企业钓鱼演练


实战 | 实战一次完整的BC网站渗透测试


实战 | 记一次渗透非法网站并成功提权的案例


实战 | 记一次wooyun漏洞库意外发现的后门


干货 | 2022年最详细的Github黑客语法总结

原文始发于微信公众号(HACK学习君):干货 | 2022年最详细的Github黑客语法总结

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年7月12日01:10:30
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   干货 | 2022年最详细的Github黑客语法总结http://cn-sec.com/archives/1161287.html

发表评论

匿名网友 填写信息