loading
Loading content
loading
Recon
Automate GitHub and GitLab dorking from a target list.
overview
Feed dorky a target list when you need bulk username, repository, and organization matches on GitHub and GitLab without hand-running platform search.
Toggle -u, -r, and -o per category. Restrict to one host with -gh or -gl, cap volume with -max, and use -s when matches must pipe into a secret scanner.
Trickest supplies the managed Recon node with a target list and token files; outputs a folder and a file. Follow with dora or dumpsterdiver on discovered repos. Use enumerepo when valid GitHub usernames already need full public-repo expansion.
source github.com/codingo/dorky
use cases
Search GitHub and GitLab for repositories and organizations tied to a target list, surfacing code that belongs to the org but lives outside its main account.
Enable username search with -u to discover developer accounts associated with an organization, a useful pivot for further OSINT.
Use -s for simple output so matched repositories pipe straight into a credential scanner and leaked keys in public code get caught.
Pass -gh or -gl when you only care about GitHub or GitLab, cutting noise and API spend on the platform you skip.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FILE | · | List of targets to search for. |
| max | STRING | -max | Maximum search results per category (default 10). |
| username | BOOLEAN | -u | Search for username matches. |
| repository | BOOLEAN | -r | Search for repository names. |
| organization | BOOLEAN | -o | Search for organization names. |
| github-only | BOOLEAN | -gh | Search only GitHub. |
| gitlab-only | BOOLEAN | -gl | Search only GitLab. |
| simple | BOOLEAN | -s | Simple output style for piping to another tool. |
Showing key inputs. dorky exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| max | STRING | -max | maximum search results per category (default 10) |
| input | FILE | · | list of targets |
| simple | BOOLEAN | -s | simple output style for piping to another tool |
| verbose | BOOLEAN | -v | enable verbose mode |
| username | BOOLEAN | -u | search for username matches |
| repository | BOOLEAN | -r | search for repository names |
| github-only | BOOLEAN | -gh | search only GitHub |
| gitlab-only | BOOLEAN | -gl | search only GitLab |
| organization | BOOLEAN | -o | search for organization names |
| clean-input-urls | BOOLEAN | -c | clean input URLs |
| github-access-token | FILE | · | GitHub access token |
| gitlab-access-token | FILE | · | GitLab access token |
example
# dorky: GitHub usernames, repos, and orgs from a target listdorky -u -r -o -gh -max 20 -s targets.txthttps://github.com/example-orghttps://github.com/example-org/web-frontendhttps://github.com/example-org/payments-apihttps://github.com/example-org/infra-terraformhttps://github.com/example-devhttps://github.com/example-dev/ci-runnershttps://github.com/example-test/docs-sitehttps://github.com/example-app/mobile-clientguidance
Use dorky to automate GitHub and GitLab discovery from a target list when you want usernames, repos, or orgs in bulk. Scan found repositories for leaked credentials with dora or dumpsterdiver. Enumerate every public repo for known usernames with enumerepo.
Lists all public repositories for valid GitHub usernames. dorky searches GitHub and GitLab for usernames, repos, and orgs from a target list.
Scans repositories you find for exposed keys. A natural next step after dorky.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A target list feeds dorky, which finds matching repositories on GitHub and GitLab and passes them to dora so leaked keys land as a queryable output.
Facts on this page come from the live Trickest tool library.