loading
Loading content
loading
Discovery
Regex hunt for exposed API keys with exploitation hints.
overview
Point dora at a file or cloned git folder when regex matches for exposed API keys matter, and recognized types need exploitation hints for triage.
Load stack-specific patterns with --json. Pass path or type filters through --rg-arguments. Use -d or --verbose when custom rules still need tuning before a wide run.
Trickest runs dora as a managed Discovery node: folder or file in, folder and file out. Recover remote .git with dvcsripper-git first when needed. Prefer dumpsterdiver for entropy sweeps over mixed dumps.
source github.com/sdushantha/dora
use cases
Scan a cloned git folder for credential patterns so cloud and service keys committed by mistake surface before an attacker finds them.
Let dora map recognized key types to exploitation methods, so a finding comes with how the key could be abused rather than only a string match.
Load a JSON regex file with patterns for internal token formats so the scan catches credentials specific to your services.
Pass --rg-arguments to constrain path globs, file types, or case handling when a default sweep is too noisy.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| git | FOLDER | · | Folder to test |
| file | FILE | · | File to test |
| json-regex | FILE | --json | Load regex data from a valid JSON file |
| rg-arguments | STRING | --rg-arguments | Arguments you want to provide to ripgrep |
| verbose | BOOLEAN | --verbose | Verbose mode |
| debug | BOOLEAN | -d | Debug mode |
| no-color | BOOLEAN | --no-color | No color |
Showing key inputs. dora exposes 7 inputs in total.
example
# scan a cloned repo for exposed keys with verbose match detaildora ./repo --verbose --no-color[+] Scanning ./repo[!] AWS Access Key ID File: ./repo/config/deploy.env:12 Match: AKIAIOSFODNN7EXAMPLE Hint: enumerate IAM with sts:GetCallerIdentity[!] Slack Bot Token File: ./repo/services/notify.py:88 Match: xoxb-000000000000-exampletoken Hint: list channels / post messages via Web API[*] 2 key types matched across 1 pathguidance
Use dora when a file or repository needs regex API-key hunting with exploitation context on hits. Prefer dumpsterdiver for broader secret detection across mixed data. Recover a remote .git with dvcsripper-git first when the tree is not local yet.
Entropy and rule-based secret hunting across large data volumes. dora stays on regex key matches with exploitation hints.
Rips a remote .git folder. Run it before dora when the repository is not already on disk.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A git repository feeds dora, which matches its regex set against the content and writes the exposed keys, with exploitation context, as a queryable output.
Facts on this page come from the live Trickest tool library.