audit.py

from __future__ import print_function
import json
import subprocess
import argparse
import sys


def search_files(repo, data):
    positives = 0
    for entry in data:
        cmd = "git -C {} log --all --full-history --abbrev-commit --pretty=oneline -- **/{}".format(repo, entry)
        out = subprocess.check_output(cmd, shell=True)
        if out:
            positives += 1
            print("Found the file {} in these commits:".format(entry))
            print(out)
    return positives


def search_strings(repo, data):
    positives = 0
    for entry in data:
        cmd = "git --no-pager -C {} log -G'{}' --all --full-history --abbrev-commit --pretty=oneline".format(repo, entry)
        out = subprocess.check_output(cmd, shell=True)

        if out:
            positives += 1
            print("Found the string {} in these commits:".format(entry))
            print(out)
    return positives


def work(repo):
    with open("dorks.json") as f:
        data = json.loads(f.read())

        total = search_files(repo, data["files"])
        if total:
            print("Found {} dork occurences in file names, check the output.".format(total))
        else:
            print("All good, searched for {} file patterns.\n".format(len(data["files"])))

        total = search_strings(repo, data["strings"])
        if total:
            print("Found {} dork strings in the sources, check the output.".format(total))
        else:
            print("All good, searched for {} file patterns.".format(len(data["strings"])))


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('repo')
    args = parser.parse_args()
    work(args.repo)

dorks.json

{
    "files": [
        "dockercfg",
        "*.pem",
        "*.ppk",
        "id_rsa",
        "id_dsa",
        "credentials",
        ".s3cfg",
        ".env",
        ".git-credentials",
        ".bashrc",
        ".bash_profile",
        ".netrc",
        "_netrc",
        "connections.xml",
        "express.conf",
        ".pgpass",
        "proftpdpasswd",
        "server.cfg",
        ".bash_history",
        ".cshrc",
        ".history",
        ".sh_history",
        "sshd_config",
        "dhcpd.conf",
        "shadow",
        "passwd",
        "sftp-config.json",
        ".esmtprc",
        ".mlab.com",
        "logins.json"
    ],
    "strings": [
        "API_KEY",
        "api_key",
        "DD_API_KEY",
        "PT_TOKEN",
        "JEKYLL_GITHUB_TOKEN",
        "client_secret",
        "HOMEBREW_GITHUB_API_TOKEN",
        "SECRET_KEY",
        "^[a-zA-Z0-9]{32}$",
        "\"[a-zA-Z0-9]{32}\""
    ]
}