GitMiner
An advanced search and automation tool for mining code and sensitive information from public GitHub repositories.
What is GitMiner?
GitMiner is a security-focused tool that automates the process of searching GitHub's public repositories for code snippets, configuration files, and other data that may contain sensitive information like passwords or API keys. It helps security researchers and developers identify accidental exposures of confidential data in public codebases. The tool uses GitHub's search capabilities programmatically to scan for specific patterns and vulnerabilities.
Security researchers, penetration testers, and developers interested in identifying and mitigating the risks of sensitive data exposure in public repositories.
GitMiner provides an automated, scriptable way to perform deep searches on GitHub, going beyond manual browsing to efficiently uncover hidden secrets. Its modular design and support for custom queries make it a flexible tool for security assessments and awareness campaigns.
Overview
Tool for advanced mining for content on Github
Use Cases
Best For
- Finding exposed credentials (passwords, API keys) in public GitHub repositories
- Automating security audits of open-source projects for sensitive data leaks
- Discovering misconfigured configuration files (e.g., wp-config.php, .env) on GitHub
- Educational demonstrations of the risks of storing secrets in version control
- Performing reconnaissance during penetration testing engagements
- Monitoring for accidental commits of private keys or certificates
Not Ideal For
- Projects requiring active maintenance and support, as GitMiner is deprecated and replaced by GitMiner3
- Teams needing compatibility with GitHub's latest API changes, since the tool is outdated and may not function correctly
- Legal or compliance-focused security audits, due to the tool's deprecated status and potential for misuse without updates
Pros & Cons
Pros
It automates complex GitHub search queries using advanced syntax, enabling efficient discovery of files by filename, path, or content, as demonstrated in the examples like 'filename:shadow path:etc'.
Includes predefined modules for targets like WordPress and Joomla, which streamline common security audits by focusing on known vulnerability patterns without manual query crafting.
Saves results to files and supports Docker, making it easy to integrate into workflows and run in isolated environments, as shown in the installation and example sections.
Cons
Marked as deprecated with no updates or support, as the README explicitly states to migrate to GitMiner3, risking bugs and incompatibilities with current systems.
Requires handling GitHub session cookies manually via the -c flag, which is cumbersome and error-prone, as highlighted in the help section with a long cookie string.
Relies on older Python libraries and may not adapt to GitHub's evolving API limits or features, leading to potential functionality failures in modern environments.
Frequently Asked Questions
Related Projects
GitleaksFind secrets with Gitleaks 🔑
LinkFinderA python script that finds endpoints in JavaScript files
CSS-KeyloggingChrome extension and Express server that exploits keylogging abilities of CSS.
HTTPLeaksHTTPLeaks - All possible ways, a website can leak HTTP requests
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.