Tune into our first episode of Tool Talk: a how-to series for hackers. REGISTER ›

Offensive Tools

GitGot: Rapidly search troves of public data on GitHub

GitGot uses blacklisting through user-provided string constants (user names, repo names, and file names) and fuzzy matching against similar file contents.

About GitGot

The tool leverages the GitHub Search API to perform searches across GitHub, and uses the blacklist mechanism to prune search results.

Search through troves of public data on GitHub for sensitive secrets.


How it Works

During search sessions, users will provide feedback to GitGot about search results to ignore, and GitGot prunes the set of results. Users can blacklist files by filename, repository name, username, or a fuzzy match of the file contents.

Blacklists generated from previous sessions can be saved and reused against similar queries (e.g., example.com v.s. subdomain.example.com v.s. Example Org). Sessions can also be paused and resumed at any time.


UI Commands

  • Ignore similar [c]ontent: Blacklists a fuzzy hash of the file contents to ignore future results that are similar to the selected file
  • Ignore [r]epo/[u]ser/[f]ilename: Ignores future results by blacklisting selected strings
  • Search [/(mykeyword)]: Provides a custom regex expression with a capture group to searches on-the-fly (e.g., /(secretToken))
  • [a]dd to Log: Add RegEx matches to log file, including all on-the-fly search results from search command
  • Next[<Enter>], [b]ack: Advances through search results, or returns to previous results
  • [s]ave state: Saves the blacklists and progress in the search results from the session
  • [q]uit: Quit
Bishop Fox Labs Security Researcher Jake Miller

Lead Researcher

Jake Miller

Jake Miller (OSCE, OSCP) is a Bishop Fox alumnus and former lead researcher. While at Bishop Fox, Jake was responsible for overseeing firm-wide research initiatives. He also produced award-winning research in addition to several popular hacking tools like RMIScout and GitGot.

Twitter: @theBumbleSec

GitHub: the-bumble

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.