Recon
Map usernames, repos, and orgs from a target list
Automate GitHub and GitLab dorking from a target list.
overview
What dorky does
Feed dorky a target list when you need bulk username, repository, and organization matches on GitHub and GitLab without hand-running platform search.
Toggle -u, -r, and -o per category. Restrict to one host with -gh or -gl, cap volume with -max, and use -s when matches must pipe into a secret scanner.
Trickest supplies the managed Recon node with a target list and token files; outputs a folder and a file. Follow with dora or dumpsterdiver on discovered repos. Use enumerepo when valid GitHub usernames already need full public-repo expansion.
source github.com/codingo/dorky
use cases
Where dorky fits
Map an organization's code footprint
Search GitHub and GitLab for repositories and organizations tied to a target list, surfacing code that belongs to the org but lives outside its main account.
Find usernames tied to a target
Enable username search with -u to discover developer accounts associated with an organization, a useful pivot for further OSINT.
Feed repositories into secret scanning
Use -s for simple output so matched repositories pipe straight into a credential scanner and leaked keys in public code get caught.
Scope to one platform
Pass -gh or -gl when you only care about GitHub or GitLab, cutting noise and API spend on the platform you skip.
reference
dorky inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FILE | · | List of targets to search for. |
| max | STRING | -max | Maximum search results per category (default 10). |
| username | BOOLEAN | -u | Search for username matches. |
| repository | BOOLEAN | -r | Search for repository names. |
| organization | BOOLEAN | -o | Search for organization names. |
| github-only | BOOLEAN | -gh | Search only GitHub. |
| gitlab-only | BOOLEAN | -gl | Search only GitLab. |
| simple | BOOLEAN | -s | Simple output style for piping to another tool. |
Showing key inputs. dorky exposes 12 inputs in total.
Full flag reference (12 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| max | STRING | -max | maximum search results per category (default 10) |
| input | FILE | · | list of targets |
| simple | BOOLEAN | -s | simple output style for piping to another tool |
| verbose | BOOLEAN | -v | enable verbose mode |
| username | BOOLEAN | -u | search for username matches |
| repository | BOOLEAN | -r | search for repository names |
| github-only | BOOLEAN | -gh | search only GitHub |
| gitlab-only | BOOLEAN | -gl | search only GitLab |
| organization | BOOLEAN | -o | search for organization names |
| clean-input-urls | BOOLEAN | -c | clean input URLs |
| github-access-token | FILE | · | GitHub access token |
| gitlab-access-token | FILE | · | GitLab access token |
example
Run dorky
# dorky: GitHub usernames, repos, and orgs from a target listdorky -u -r -o -gh -max 20 -s targets.txthttps://github.com/example-orghttps://github.com/example-org/web-frontendhttps://github.com/example-org/payments-apihttps://github.com/example-org/infra-terraformhttps://github.com/example-devhttps://github.com/example-dev/ci-runnershttps://github.com/example-test/docs-sitehttps://github.com/example-app/mobile-clientguidance
Choosing dorky
Use dorky to automate GitHub and GitLab discovery from a target list when you want usernames, repos, or orgs in bulk. Scan found repositories for leaked credentials with dora or dumpsterdiver. Enumerate every public repo for known usernames with enumerepo.
enumerepo
Lists all public repositories for valid GitHub usernames. dorky searches GitHub and GitLab for usernames, repos, and orgs from a target list.
dora
Scans repositories you find for exposed keys. A natural next step after dorky.
faq
dorky questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run dorky yourself
A target list feeds dorky, which finds matching repositories on GitHub and GitLab and passes them to dora so leaked keys land as a queryable output.
Facts on this page come from the live Trickest tool library.