loading
Loading content
loading
Discovery
Regex hunt for exposed API keys with exploitation hints.
overview
Point dora at a file or cloned git folder when regex matches for exposed API keys matter, and recognized types need exploitation hints for triage.
Load stack-specific patterns with --json. Pass path or type filters through --rg-arguments. Use -d or --verbose when custom rules still need tuning before a wide run.
Trickest runs dora as a managed Discovery node: folder or file in, folder and file out. Recover remote .git with dvcsripper-git first when needed. Prefer dumpsterdiver for entropy sweeps over mixed dumps.
source github.com/sdushantha/dora
use cases
Scan a cloned git folder for credential patterns so cloud and service keys committed by mistake surface before an attacker finds them.
Let dora map recognized key types to exploitation methods, so a finding comes with how the key could be abused rather than only a string match.
Load a JSON regex file with patterns for internal token formats so the scan catches credentials specific to your services.
Pass --rg-arguments to constrain path globs, file types, or case handling when a default sweep is too noisy.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| git | FOLDER | · | Folder to test |
| file | FILE | · | File to test |
| json-regex | FILE | --json | Load regex data from a valid JSON file |
| rg-arguments | STRING | --rg-arguments | Arguments you want to provide to ripgrep |
| verbose | BOOLEAN | --verbose | Verbose mode |
| debug | BOOLEAN | -d | Debug mode |
| no-color | BOOLEAN | --no-color | No color |
Showing key inputs. dora exposes 7 inputs in total.
example
# scan a cloned repo for exposed keys with verbose match detaildora ./repo --verbose --no-color[+] Scanning ./repo[!] AWS Access Key ID File: ./repo/config/deploy.env:12 Match: AKIAIOSFODNN7EXAMPLE Hint: enumerate IAM with sts:GetCallerIdentity[!] Slack Bot Token File: ./repo/services/notify.py:88 Match: xoxb-000000000000-exampletoken Hint: list channels / post messages via Web API[*] 2 key types matched across 1 pathguidance
Use dora when a file or repository needs regex API-key hunting with exploitation context on hits. Prefer dumpsterdiver for broader secret detection across mixed data. Recover a remote .git with dvcsripper-git first when the tree is not local yet.
Entropy and rule-based secret hunting across large data volumes. dora stays on regex key matches with exploitation hints.
Rips a remote .git folder. Run it before dora when the repository is not already on disk.
faq
related
Extract URLs and endpoints from Android APK files.
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
Browser-driven crawler that harvests requests for downstream scanners.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
A git repository feeds dora, which matches its regex set against the content and writes the exposed keys, with exploitation context, as a queryable output.
Facts on this page come from the live Trickest tool library.