OSINT
Map every public GitHub repo owned by known usernames
List public repositories for each GitHub username you already have.
overview
What enumerepo does
You have GitHub usernames (developers or org members). enumerepo expands each login into every public repository URL via the GitHub GraphQL API, so the code footprint is a file instead of a manual profile walk.
Auth with -token-file or -token-string. Space GraphQL calls with -delay (ms) or let -adjust-delay tune the gap when limits tighten. -silent keeps stdout quiet when you only want the written output.
Trickest runs enumerepo as a managed OSINT node: feed a usernames file and token, get a folder and file of repo URLs ready for a secret scanner such as dora or dumpsterdiver.
use cases
Where enumerepo fits
Map a user's public repositories
List every public repo a GitHub username owns so you can scope an organization's code footprint from a set of known accounts.
Stay within GitHub rate limits
Set a request delay or turn on automatic adjustment so a large enumeration runs to completion without tripping GraphQL throttling.
Feed repositories into secret scanning
Pass the discovered repositories to a credential scanner so hardcoded keys and tokens in public code surface for remediation.
Watch an org's public code over time
Run enumerepo on a schedule and diff the repository list to catch newly published or forked projects as they appear.
reference
enumerepo inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| usernames | FILE | -usernames | File to read usernames from. |
| token-file | FILE | -token-file | File to read the GitHub token from. |
| token-string | STRING | -token-string | GitHub token as a string. |
| delay | STRING | -delay | Time delay after every GraphQL request, in milliseconds. |
| adjust-delay | BOOLEAN | -adjust-delay | Automatically adjust the delay between requests. |
| silent | BOOLEAN | -silent | Do not print output to stdout. |
Showing key inputs. enumerepo exposes 6 inputs in total.
example
Run enumerepo
# list every public repo for a set of GitHub users, tuning the delay automaticallyenumerepo -usernames users.txt -token-file token.txt -adjust-delay[ { "user": "https://github.com/example-org", "repos": [ "https://github.com/example-org/web-frontend", "https://github.com/example-org/payments-api", "https://github.com/example-org/infra-terraform" ] }]guidance
Choosing enumerepo
Use enumerepo when you already have GitHub usernames and need every public repo they own in bulk. Discover usernames and orgs first with dorky. For leaked credentials in those repos, follow with dora or dumpsterdiver.
dorky
Searches GitHub and GitLab for usernames, repos, and orgs. enumerepo expands known usernames into full public repo lists.
dora
Scans enumerated repositories for exposed API keys. Natural next hop after enumerepo.
faq
enumerepo questions
related
More OSINT tools
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
dnstwist
Generate lookalike domains and flag registered typosquats.
favup
Look up the real IP of a host from its favicon via Shodan.
Infoga
Email OSINT from public sources, with optional breach checks.
maigret
Username search that collects accounts and profile data into one dossier.
socialscan
Check whether emails and usernames are available, taken, or invalid.
Run enumerepo yourself
A usernames file feeds enumerepo, which lists every public repository for each user and passes them to dora so leaked keys land as a queryable output.
Facts on this page come from the live Trickest tool library.