"GitHub Recon" refers to the process of gathering information from GitHub, a web-based platform that provides hosting for software development projects. This information can be used to conduct security testing, vulnerability scanning, or general research related to a target organization or individual.
keywords |
---|
1password |
.accdb |
access |
access_key |
access.log |
access_log |
access_token |
Access token |
account |
account.json |
acl |
ads.txt |
Amazon Elastic Compute Cloud (EC2) user data scripts |
Amazon Elastic Kubernetes Service (EKS) configuration files |
Amazon Elastic MapReduce (EMR) configuration files |
Amazon Relational Database Service (RDS) configuration files |
Amazon Simple Storage Service (S3) bucket policies |
Amazon Web Services (AWS) CloudFormation templates |
Amazon Web Services Identity and Access Management (IAM) policies |
analytics |
ansible |
ansible-aws-access-key |
ansible-aws-secret-key |
ansible.cfg |
.ansible.cfg file |
ansible-credentials |
ansible-docker |
ansible-ec2 |
ansible-environment |
ansible-galaxy |
ansible-group |
ansible-host |
ansible-hosts |
ansible-identity |
ansible-inventory |
ansible.inventory |
ansible-kubernetes |
ansible-lint |
ansible-pass |
ansible-password |
ansible-play |
ansible-playbook |
Ansible playbooks |
Ansible playbooks and configuration files |
ansible-role |
ansible-secret |
ansible-ssh |
ansible-ssh-key |
ansible-sudo |
ansible-task |
ansible-tower |
ansible-user |
ansible-vars |
ansible-vault |
ansible-vault-id |
ansible-vault-key |
ansible-vault-pass |
ansible-vault-password |
apache_config |
Apache configuration files (e.g. httpd.conf, nginx.conf) |
api |
api-docs.yml |
API documentation |
API endpoints |
api_key |
API key |
API_key |
API keys |
API secrets |
API tokens |
appcenter_access_token |
app.config |
application |
app_secret |
appsettings.json |
appsettings.xml |
artifactory_password |
artifactory_username |
artifacts |
asana_access_token |
asana_refresh_token |
.asc |
auth |
auth0 |
authentication |
auth_key |
authorize |
authorized_keys |
authorize_net_secret |
auth_token |
aws |
aws_access_key |
AWS access key |
aws_access_key_id |
aws_account_id |
aws_bucket |
AWS CloudFormation stack output values |
aws_cloudfront_keypair_id |
aws/config |
.aws/credentials |
aws/credentials |
aws_credentials |
aws_db_password |
aws_default_region |
aws_ec2_access_key |
AWS EC2 instance metadata |
aws_ec2_private_key |
aws_ec2_secret_key |
AWS EC2 security groups |
AWS ECS task definitions |
aws/eks/ |
AWS EKS cluster configurations |
AWS Elastic Beanstalk environment variables |
AWS EMR cluster configurations |
aws_encryption_key |
AWS IAM policies |
aws_iam_role_arn |
aws_iam_user_name |
AWS IAM users and groups |
aws/instance-credentials/ |
aws_instance_id |
aws_key_pair_name |
aws_keys |
aws_kms_key_id |
aws/lambda/ |
AWS Lambda function code |
aws_lambda_function_name |
AWS RDS database instance configurations |
aws_rds_instance_name |
aws_redshift_cluster_name |
aws_region |
aws_region_name |
aws/roles |
aws_route53_zone_id |
aws_s3_bucket |
aws_s3_bucket_name |
AWS S3 bucket policies |
aws_s3_bucket_url |
aws_secret_access_key |
aws_secret_key |
AWS secret key |
aws_security_token |
aws_session_token |
aws_sns_topic_arn |
aws/sqs/ |
aws_sqs_queue |
AWS SSM parameters |
azure |
azure_app_client_id |
azure_app_client_secret |
azure_app_insights_key |
azure_app_region |
azure_app_subscription_id |
azure_app_tenant_id |
azureauth.properties |
azure_client_id |
azure_client_secret |
azure_cognitive_services_key |
azure_cosmosdb_key |
azure_eventgrid_key |
azure_eventhub_connection_string |
azure_function_app_name |
Azure key |
azure_key_vault_uri |
Azure Kubernetes Service configurations |
azure_notification_hub_connection_string |
azure-pipelines.yml |
Azure Resource Manager templates |
azure_search_key |
azure_servicebus_connection_string |
azure_signalr_connection_string |
azure_storage_account |
azure_storage_account_key |
azure_storage_connection_string |
azure_subscription_id |
azure_tenant_id |
Azure Virtual Machine extensions |
Backdoor scripts |
Back-end source code |
backup |
Backup database dumps (e.g. MySQL dump, PostgreSQL dump) |
backup.tar.gz |
.bak |
Bamboo plan configuration |
base_url |
.bash_aliases |
.bash_history |
Bash history |
.bash_logout |
.bash_logout file |
.bash_profile |
.bash_profile file |
.bashrc |
.bashrc file |
bearer |
bearer_token |
beta |
bin |
Binaries and executables |
bitbucket |
bitbucket_access_token |
Bitbucket pipeline |
bitbucket_pipelines_token |
bitbucket_refresh_token |
bitbucket_token |
bitcoin |
bitly_access_token |
bitly_oauth_token |
blob_storage |
blog |
bootstrap |
Bootstrap |
Bot or automation scripts |
bot_token |
bower |
box |
box_access_token |
box_app_key |
box_app_secret |
box_app_token |
box_client_id |
box_client_secret |
braintree_private_key |
braintree_public_key |
browserstack_access_key |
browserstack_username |
bucket |
bugsnag_api_key |
build |
Build scripts |
cacher |
calendar |
callback |
captcha |
.cargo/config |
.cargo/credentials |
.cer |
certificate |
certs |
changelog |
Chef cookbooks and configuration files |
Ciphertext files containing sensitive data |
CircleCI |
CircleCI config file |
CircleCI configuration files |
circleci_token |
client.crt |
client_secret |
client_secrets.json |
cloudflare_api_key |
CloudFormation templates |
cloudinary_api_key |
Code signing certificates and keys |
Code snippets for database access or query execution |
Command history |
composer.json |
composer.lock |
Composer.lock |
.conf |
Config file |
config.inc |
Configuration file |
Configuration files for application servers (e.g. Tomcat, JBoss) |
Configuration files for blogging platforms (e.g. WordPress, Ghost) |
Configuration files for chat applications (e.g. Slack, Discord) |
Configuration files for container orchestration tools (e.g. Kubernetes, Docker Swarm) |
Configuration files for content management systems (e.g. Drupal, Joomla) |
Configuration files for continuous integration tools (e.g. Jenkins, Bamboo) |
Configuration files for e-commerce platforms (e.g. Magento, Shopify) |
Configuration files for firewalls (e.g. iptables, pf) |
Configuration files for forum software (e.g. phpBB, vBulletin) |
Configuration files for issue tracking systems (e.g. JIRA, Bugzilla) |
Configuration files for load balancers (e.g. HAProxy, NGINX) |
Configuration files for log aggregation and analysis tools (e.g. ELK stack) |
Configuration files for message queueing systems (e.g. RabbitMQ, Apache Kafka) |
Configuration files for monitoring tools (e.g. Nagios, Zabbix) |
Configuration files for proxies (e.g. Squid) |
Configuration files for reverse proxies (e.g. Apache mod_proxy, NGINX) |
Configuration files for virtualization platforms (e.g. VMware, VirtualBox) |
Configuration files for web application firewalls (e.g. ModSecurity) |
Configuration files for web application proxies (e.g. Burp Suite, ZAP Proxy) |
Configuration files for web servers (e.g. Apache, Nginx) |
configuration.yml |
config.yaml |
connection_string |
connectionStrings.config |
Cookie |
credentials |
Credentials |
Credentials for third-party APIs or services used by the application |
credit card numbers |
creds.txt |
Cross-site request forgery |
Cross-site scripting |
.crt |
.csr |
CSRF |
.csv |
.curlrc file |
CVS repositories |
database |
Database connection failed |
Database connection failed: incorrect credentials |
database_password |
Database password |
database_url |
database.yml |
.db |
db_pass |
db_password |
db_user |
db_username |
decryption_key |
Deployment scripts |
.der |
Desktop.ini file |
dev |
Development notes or documents |
digitalocean_access_token |
discord_api_key |
discord_token |
discord_webhook_url |
.doc |
docker_api_key |
docker_compose |
docker-compose.yml |
Docker-compose.yml |
docker_config |
dockerfile |
Dockerfile |
Dockerfiles |
Dockerfiles and Docker Compose files |
.dockerignore file |
Docker image build logs |
docker_password |
docker_username |
.docx |
Dropbox |
dropbox_access_token |
dropbox_app_secret |
dropbox_app_token |
Drupal |
.DS_Store |
.DS_Store file |
.DS_Store files |
ElasticSearch config file |
Elasticsearch index names |
elasticsearch_password |
elasticsearch_username |
.emacs file |
email addresses |
email_password |
encryption_key |
Encryption key |
Encryption keys or passwords for data at rest |
.env |
.env.dev |
.env.development |
.env.development file |
.env.development.local |
.env file |
Environment variable |
.env.local |
.env.local file |
.env.private |
.env.prod |
.env.production |
.env.production file |
.env.production.local |
.env.secret |
.env.staging |
.env.staging.local |
.env.test |
.env.test file |
.env.test.local |
error.log |
error_log |
facebook_api_key |
Facebook Pixel |
Failed to load encryption key |
financials |
firebase_admin_key |
firebase_adminsdk |
firebase_api_key |
firebase_auth_domain |
firebase_auth_key |
firebase_client_key |
firebase_config |
firebase_database_url |
firebase_project_id |
firebase_storage_bucket |
firebase_token |
firebase_web_api_key |
freshbooks_api_secret |
freshbooks_api_token |
ftp_password |
function |
gcp_auth_provider_x509_cert_url |
gcp_client_email |
gcp_client_id |
gcp_client_x509_cert_url |
gcp_credentials |
gcp_private_key |
gcp_private_key_id |
gcp_project |
gcp_project_id |
gcp_service_account |
gcp_storage_bucket |
gcp_storage_key |
gcp_token_uri |
.gem/credentials |
Gemfile |
Gemfile file |
Gemfile.lock |
Gemfile.lock file |
.gitattributes file |
.gitconfig |
gitconfig |
.gitconfig file |
.git-credentials |
GitHub Actions |
GitHub Actions configuration files |
GitHub Actions workflow |
github_api_key |
github_app_secret |
github_app_token |
github_token |
.gitignore |
gitignore |
.gitignore file |
gitlab_access_token |
GitLab CI/CD configuration file |
gitlab_ci_token |
gitlab-ci.yml |
.gitlab-ci.yml file |
gitlab_deploy_token |
gitlab_private_token |
gitlab_token |
.gitmodules file |
Git submodules |
Google Analytics |
google_analytics_tracking_id |
google_api_key |
google_application_credentials |
google-auth.json |
google_calendar_api_key |
google_client_secret |
google-cloud |
Google Cloud Compute Engine instance configurations |
Google Cloud Functions code |
Google Cloud IAM policies |
Google Cloud key |
google_cloud_platform_project_id |
google_cloud_platform_project_number |
Google Cloud Platform service account keys |
google_cloud_project_id |
Google Cloud SQL database instance configurations |
google_cloud_storage_bucket |
Google Cloud Storage bucket policies |
google_compute_engine |
Google Drive |
google_drive_api_key |
google_drive_client_id |
google_drive_client_secret |
google_firebase_api_key |
google_geocoding_api_key |
google_maps_api_key |
google_oauth_client_id |
google_oauth_client_secret |
google_oauth_refresh_token |
google_oauth_secret |
google_oauth_token |
google_places_api_key |
google_recaptcha_secret |
google_search_api_key |
google_service_account |
google-services.json |
.gpg |
GPG private keys |
Gradle.build |
grafana_admin_password |
Grafana config file |
.group |
HashiCorp Terraform configuration files |
heroku_api_key |
heroku_api_token |
heroku_app_name |
heroku_username |
.hgignore file |
hockeyapp_api_token |
hockeyapp_app_token |
hockeyapp_secret |
hootsuite_api_key |
.htaccess |
.htaccess_backup |
.htaccess.bak |
.htaccess.bkp |
.htaccess.copy |
.htaccess_default |
.htaccess-dist |
.htaccess-example |
.htaccess.example |
.htaccess file |
.htaccess.old |
.htaccess.old.1 |
.htaccess.orig |
.htaccess_orig |
.htaccess_original |
.htaccess.sample |
.htaccess.sample.txt |
.htaccess.txt |
.htgroups |
.htpasswd |
.htpasswd file |
.htpasswds |
id_dsa |
.idea |
id_ecdsa |
id_ed25519 |
id_rsa |
id_token |
imap_password |
Infrastructure-as-Code (IaC) templates |
Infrastructure monitoring configurations |
.ini |
INI file |
.inputrc file |
instagram_access_token |
instagram_api_key |
intercom_access_token |
intercom_api_key |
Invalid access token |
Jenkinsfile |
jenkins_password |
Jenkins pipeline configuration files |
Jenkins pipeline scripts |
jenkins_username |
jira_access_token |
jira_api_key |
jira_api_token |
.jks |
jQuery |
.json |
jwt |
JWT |
jwt_secret |
jwt_token |
JWT tokens |
.key |
key |
.keychain |
.keystore |
Kibana config file |
kibana_password |
kibana_username |
Known vulnerabilities or CVEs |
kubeconfig |
Kubeconfig file |
kubectl.config |
Kubernetes config file |
Kubernetes configuration files |
Kubernetes secrets |
Kubernetes YAML files |
lambda |
LDAP injection |
linkedin_access_token |
local_settings.py |
.log |
Log files with sensitive information |
LogMeIn |
logs |
Logstash config file |
Magento |
mailchimp_api_key |
mailgun_api |
mailgun_api_key |
mandrill_api_key |
.markdown |
Maven pom.xml |
.mdb |
Mercurial repositories |
microsoft_app_id |
microsoft_app_secret |
microsoft_azure_app_service_storage |
microsoft_azure_client_id |
microsoft_azure_client_secret |
microsoft_azure_cosmosdb_connection_string |
microsoft_azure_key |
microsoft_azure_key_vault_secret_id |
microsoft_azure_secret |
microsoft_azure_storage_account_key |
microsoft_azure_storage_account_name |
microsoft_azure_storage_connection_string |
microsoft_azure_subscription_id |
microsoft_azure_tenant |
microsoft_azure_tenant_id |
microsoft_client_id |
microsoft_client_secret |
microsoft_service_principal_client_id |
microsoft_service_principal_secret |
microsoft_tenant_id |
mixpanel_api_key |
MongoDB connection strings |
mongodb_password |
mongodb_uri |
.my.cnf |
mysql |
mysql_password |
netlify_access_token |
.netrc |
Network configuration files (e.g. iptables, firewalld) |
nexmo_api_key |
nexmo_api_secret |
nexmo_phone_number |
nexus_password |
nexus_username |
nginx.conf |
nginx_config |
npm_auth_token |
.npmignore |
.npmrc |
.npmrc file |
.npmrc.local |
oauth |
OAuth |
oauth2.json |
oauth_access_token |
oauth_client_secret |
oauth_secret |
oauth_token |
OAuth tokens |
oauth_token_secret |
.ods |
.odt |
.old |
old_files |
openvpn.conf |
Oracle connection strings |
.orig |
.p12 |
package.json |
Package.json |
package.json file |
package-lock.json |
package-lock.json file |
passcode |
pass.txt |
.passwd |
passwd |
password |
Password |
password_digest |
password_hash |
Password reset functionality |
password_salt |
passwords.txt |
PayPal |
paypal_api_key |
paypal_api_password |
paypal_api_secret |
paypal_api_signature |
paypal_api_username |
paypal_client_id |
paypal_client_secret |
paypal_secret |
.pem |
pem_key |
personal_access_token |
.pfx |
.pgp |
.pgpass |
pgpass |
pgp_key |
pgsql |
phone numbers |
Pipfile |
Pipfile.lock |
pivotal_tracker_api_key |
pivotal_tracker_api_token |
pivotal_tracker_project_id |
pivotal_tracker_token |
.pkcs12 |
.pkcs8 |
plivo_auth_id |
plivo_auth_token |
plivo_phone_number |
pop3_password |
postgres_password |
postmark_api_token |
.ppk |
ppk_key |
private_access_token |
Private chat logs |
Private cloud storage data |
Private cryptographic keys and certificates (e.g. GPG keys) |
Private data stored in third-party services (e.g. Dropbox, Google Drive) |
Private e-mail archives |
Private encryption keys for data in transit |
private_key |
Private key |
Private keys for authentication with cloud providers (e.g. AWS, GCP, Azure) |
Private keys for cloud providers (e.g. AWS, GCP, Azure) |
Private keys for code signing |
Private keys for SSH access |
Private keys for SSL/TLS certificates |
Private message board posts |
private_rsa |
Private social media messages |
private_token |
prod_key |
production_key |
.profile |
.profile file |
project_id |
prometheus_password |
prometheus_username |
Properties file |
proposals |
proxy_password |
.psd |
.psql |
.pub |
public_key |
pubnub_api_key |
pusher_api_key |
.pythonrc file |
quickbooks_api_key |
quickbooks_api_secret |
quickbooks_oauth_secret |
quickbooks_oauth_token |
rabbitmq_password |
rabbitmq_uri |
rabbitmq_username |
React |
reddit_client_id |
reddit_client_secret |
reddit_password |
reddit_username |
Redis configuration files |
redis_url |
Remote desktop connection files (e.g. RDP files) |
requirements.txt |
Requirements.txt |
.rhosts |
.rhosts.equiv |
robots.txt |
robots.txt file |
rsa_key |
RSA key |
rsa_private_key |
.rst |
s3_access_key |
s3_bucket_name |
S3 buckets |
s3_secret_key |
salesforce_access_token |
salesforce_api_key |
salesforce_client_id |
salesforce_client_secret |
salesforce_password |
salesforce_refresh_token |
salesforce_security_token |
salesforce_username |
sauce_access_key |
saucelabs_access_key |
saucelabs_username |
sauce_username |
.screenrc file |
secret |
secret_access_key |
secret.json |
secret_key |
Secret key |
secret_key_base |
secrets.js |
secrets.json |
secrets.yml |
secret_token.rb |
Security advisories |
security measures |
security_token |
security.txt |
sendgrid_api_key |
sendinblue_api_key |
Sensitive comments in code |
Sensitive comments in code (e.g. API keys, passwords) |
Sensitive data in code reviews |
Sensitive data in git commit messages |
Sensitive data in issue tracking systems (e.g. JIRA, Bugzilla) |
Sensitive data in merge requests |
Sensitive data in pull requests |
Sensitive information in image metadata (e.g. EXIF data) |
Sensitive information in metadata files (e.g. package.json, composer.json) |
Sensitive information in test files (e.g. unit tests, integration tests) |
sercrets.properties |
server.crt |
server.key |
serverless |
server.xml |
session_id |
Session ID |
session_secret |
session_token |
settings.json |
settings.php |
settings.py |
settings.xml |
Shell history |
shopify_api_key |
shopify_api_secret |
shopify_password |
.shosts |
signing_key |
slack_api_key |
slack_api_token |
slack_app_secret |
slack_app_token |
slack_bot_token |
Slack bot tokens |
slack_client_id |
slack_client_secret |
slack_incoming_webhook |
slack_signing_secret |
slack_token |
slack_verification_token |
slack_webhook_url |
smb.conf |
smtp_password |
snapshot |
SonarQube configuration file |
SonarQube configuration files |
sonarqube_password |
sonarqube_username |
soundcloud_access_token |
Splunk config file |
splunk_password |
splunk_username |
.sql |
SQL injection |
SQL injection vulnerabilities |
.sqlite |
SQL query |
SQL Server connection strings |
square_access_token |
square_api_key |
square_application_secret |
.ssh |
.ssh/ |
.ssh/authorized_keys |
SSH authorized keys |
SSH certificate |
.ssh/config |
ssh_config |
.ssh/config file |
SSH configuration files |
SSH host keys |
.ssh/id_dsa |
.ssh/id_rsa |
.ssh/id_rsa.pub |
ssh_key |
SSH key |
ssh_keys/ |
.ssh/known_hosts |
SSH known hosts |
ssh_private_key |
SSH private keys (other than id_rsa) |
ssh_public_key |
ssl/ |
SSL certificate |
SSL certificates |
ssl_key |
SSL/TLS certificates and keys |
SSL/TLS private keys stored in Git repositories |
sso |
Stripe |
stripe_api_key |
stripe_client_id |
stripe_publishable_key |
stripe_secret |
stripe_secret_key |
stripe_webhook_secret |
.svn |
SVN authz files |
SVN dump files |
.svnignore file |
SVN repositories |
swagger.json |
System or application logs with sensitive information |
System passwords or login credentials |
TCPdump capture files |
TeamCity build configuration |
teamcity_password |
teamcity_username |
TeamViewer |
Terraform configuration files |
test |
testfairy_api_key |
testflight_api_token |
testflight_app_token |
Thumbs.db file |
Thumbs.db files |
TODO: Add SSL certificate |
token |
token |
TravisCI |
Travis CI configuration files |
travis_token |
.travis.yml |
trello_api_key |
twilio_account_auth_token |
twilio_account_sid |
twilio_api_key |
twilio_api_secret |
twilio_auth_token |
twilio_auth_token_secret |
twilio_phone_number |
twitter_access_token |
twitter_access_token_secret |
twitter_api_key |
twitter_consumer_secret |
Two-factor authentication |
.txt |
vault_token |
.viminfo file |
.vimrc |
.vimrc.bundles file |
.vimrc.bundles.local file |
.vimrc file |
.vimrc.local file |
.vscode |
Vulnerability assessment reports |
Web application configuration files (e.g. web.xml, appsettings.json) |
web.config |
Web.config file |
.well-known |
.wgetrc file |
windows_password |
win.ini |
Wireshark capture files |
WordPress |
wordpress_api_key |
wp-config.php |
xero_consumer_key |
xero_consumer_secret |
xero_private_key |
.xls |
.xlsm |
.xlsx |
.xml |
XSS |
.yaml |
YAML file |
.yarnclean |
yarn.lock |
yarn.lock file |
.yarnrc |
.yarnrc file |
.yarnrc.local |
yelp_api_key |
.yml |
zendesk_api_token |
zendesk_api_username |
zoom_account_email |
zoom_account_id |
zoom_account_password |
zoom_api_key |
zoom_api_secret |
zoom_bot_jwk_key |
zoom_bot_jwt_token |
zoom_bot_secret |
zoom_bot_token |
zoom_bot_verification_token |
zoom_client_id |
zoom_client_secret |
zoom_jwt_token |
zoom_meeting_id |
zoom_meeting_password |
zoom_recording_download_url |
zoom_recording_id |
zoom_recording_stream_url |
zoom_sso_key |
zoom_user_email |
zoom_user_id |
zoom_user_password |
zoom_vanity_url |
zoom_webhook_key |
zoom_webhook_token |
zoom_webhook_url |
zoom_webinar_id |
.zsh_aliases |
.zshenv |
.zsh_history |
.zsh_history file |
.zsh_logout |
.zsh_profile file |
.zshrc |
.zshrc file |