You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Visualize and manage your search results in real-time with the new GitHound Explore dashboard. Get started now for free at https://githoundexplore.com or by using the `--dashboard` flag. Learn how to use this with a local installation of GitHound or TruffleHog at the [Wiki page](https://github.com/tillson/git-hound/wiki/GitHound-Explore-%E2%80%93%C2%A0UI-for-result-filtering-&-cloud-scans). Keep in mind you can still use GitHound without the dashboard.
GitHound hunts down **exposed API keys, secrets, and credentials** across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a [GitHub dork](https://githoundexplore.com/github-dorks) into GitHound, and it will scan any files and repos that match your query for secrets. Unlike typical scanners, **GitHound leverages GitHub’s Code Search API**, which gives you full visibility across *all* public repositories, not just a few targets. More information is available in the [accompanying blog post](https://tillsongalloway.com/finding-sensitive-information-on-github/).
18
+
19
+
---
20
+
21
+
22
+
## New in 3.0
23
+
Visualize and manage your search results in real-time with the new GitHound Explore dashboard. Get started now for free at https://githoundexplore.com or by using the `--dashboard` flag. Learn how to use this with a local installation of GitHound or TruffleHog at the [Wiki page](https://github.com/tillson/git-hound/wiki/GitHound-Explore-%E2%80%93%C2%A0UI-for-result-filtering-&-cloud-scans). Keep in mind you can still use GitHound without the dashboard.
24
+
25
+
We've also started a **GitHub Dorks Database**, where you can browse and search dorks for various API keywords and get ideas for new dorks! Check it out at https://githoundexplore.com/github-dorks.
12
26
13
-
GitHound hunts down exposed API keys and other sensitive information on GitHub using GitHub code search, pattern matching, and commit history searching. Unlike other secret-finding tools, GitHound's use of of GitHub code search enables it to search all of GitHub and isn't limited to specific repos, users, or orgs.
14
-
More information is available in the [accompanying blog post](https://tillsongalloway.com/finding-sensitive-information-on-github/).
15
27
16
28
## Features
17
29
18
-
- GitHub/Gist code search. This enables GitHound to locate sensitive information exposed across all of GitHub, uploaded by any user.
19
-
- Sensitive data detection using pattern matching, contextual information, and string entropy
20
-
- Commit history digging to find improperly deleted sensitive information
21
-
- Scoring system that filters common false positives and optimizes intensive repo digging
22
-
- Base64 detection and decoding
23
-
- Options to build GitHound into larger systems, including JSON output and custom regexes
30
+
🔍 Global GitHub Search – find secrets across all of GitHub, including Gists
🕵️ Commit History Digging – uncover deleted or reverted credentials
35
+
36
+
🧮 Adaptive Scoring – filters out false positives
37
+
38
+
🧰 Base64 decoding and encoded secret extraction
39
+
40
+
💻 JSON output & custom regex rules for automation pipelines
24
41
25
42
## Usage
26
43
@@ -40,12 +57,6 @@ Alternatively, you can use environment variables, which will override values in
40
57
-`GITHOUND_GITHUB_TOKEN`: Sets the GitHub API access token.
41
58
-`GITHOUND_INSERT_KEY`: Sets the GitHoundExplore Insert Key for the `--dashboard` feature.
42
59
43
-
### Two-Factor Authentication
44
-
45
-
If GitHound is logged into your GitHub account, two-factor authentication may kick in. You can pass 2FA codes to GitHound with `--otp-code`.
46
-
Otherwise, GitHound will prompt you for it when it starts up.
47
-
You can also [supply your 2FA seed](https://github.com/tillson/git-hound/pull/24) in the config and you'll never have to worry about 2FA again.
48
-
Grab the 2FA seed by decoding the barcode that GitHub shows during the 2FA setup process.
49
60
50
61
## API Key Regexes
51
62
GitHound utilizes a database of API key regexes maintained by the [Gitleaks](https://github.com/zricethezav/gitleaks) authors.
@@ -166,3 +177,9 @@ Replace `/path/to/config.yaml` with the actual path to your `config.yaml` file.
166
177
## References
167
178
168
179
-[How Bad Can It Git? Characterizing Secret Leakage in Public GitHub Repositories (Meli, McNiece, Reaves)](https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf)
180
+
181
+
---
182
+
183
+
<divalign="center">
184
+
If you like GitHound, consider ⭐ starring the repo!
0 commit comments