github-endpoints-patched

README

github-endpoints-patched

Find endpoints on GitHub — patched fork of gwen001/github-endpoints v1.2.2

---

Why this fork

Two things upstream got wrong, plus the crash fixes needed to run it over a domain list.

1. Domain lists — -d took exactly one domain

Now it takes a single domain, a comma-separated list, a file, or stdin.

2. -e (extended mode) was always on

Upstream built the default-mode host filter as an unanchored regexp and tested it with FindAll, so the target matched anywhere inside a longer hostname. cat.com matched gfycat.com, bellingcat.com, revenuecat.com, navicat.com, myoctocat.com… — the -e behaviour applied whether or not you passed -e.

Measured on -d cat.com -q, same corpus, upstream binary vs this one:

	URLs returned	distinct hosts	actually cat.com	false positives
upstream v1.2.2	328	54	28	300 (91 %)
this fork	28	2	28	0

Nothing legitimate is lost — the 28 real cat.com URLs are identical between both runs. -e still works and is now the only way to get loose matching.

3. A throttled search silently reported "0 results"

GitHub code search allows 10 requests/min. When throttled, upstream disabled the token but still took TotalCount: 0 at face value and ended the search — reporting 0 endpoints for a domain it never actually searched. With a domain list on one token, most domains came back silently empty. Throttled pages are now retried.

Full technical detail, including the exact regexps and the concurrency/nil-deref/divide-by-zero fixes: MODIFICATIONS.md.

---

Install

go install github.com/mohaned2210/github-endpoints-patched@latest

That drops a binary named github-endpoints-patched into $(go env GOPATH)/bin. To keep calling it by the original name:

ln -sf "$(go env GOPATH)/bin/github-endpoints-patched" "$(go env GOPATH)/bin/github-endpoints"

Build from source instead

git clone https://github.com/mohaned2210/github-endpoints-patched
cd github-endpoints-patched
go build -o github-endpoints .
sudo install -m 0755 github-endpoints /usr/local/bin/    # or: cp github-endpoints ~/go/bin/

Verify you are on the fork — the patched build has the -df flag:

github-endpoints -h 2>&1 | grep -q '\-df' && echo "patched build" || echo "still upstream"

⚠️ If you symlinked/renamed to github-endpoints, note that go install github.com/gwen001/github-endpoints@latest writes to that same name — it replaces this build with upstream and brings all three bugs back.

Usage

Usage of github-endpoints:
  -all
    	displays urls of all other domains, default=false
  -d string
    	domain you are looking for (required), can be:
    	  • a single domain
    	  • a list of domains separated by comma
    	  • a file containing 1 domain per line
    	if the option is not provided, domains are readed from stdin
  -df string
    	file containing 1 domain per line, use - for stdin
  -e	extended mode, also look for <dummy>example.com
  -k	exit the program when all tokens have been disabled
  -o string
    	output file, default: <domain>.txt
  -q	quick mode, avoid extra searches with languages and noise added
  -r	display relative urls, default=false
  -raw
    	raw output
  -t string
    	github token (required), can be:
    	  • a single token
    	  • a list of tokens separated by comma
    	  • a file (.tokens) containing 1 token per line

Input modes

# single domain
github-endpoints -d example.com -t $GITHUB_TOKEN

# comma-separated
github-endpoints -d "example.com,example.org" -t $GITHUB_TOKEN

# a file, 1 domain per line (auto-detected on -d, or explicit with -df)
github-endpoints -d scope.txt  -t $GITHUB_TOKEN
github-endpoints -df scope.txt -t $GITHUB_TOKEN

# stdin - chain it straight off recon
subfinder -d example.com -silent | github-endpoints -q -raw -t $GITHUB_TOKEN
cat scope.txt | github-endpoints -df - -t $GITHUB_TOKEN

The list is normalised before use, so a raw scope file works as is:

# in-scope wildcards            ->  parsed as
*.example.com                       example.com
https://api.example.org:443/v1?x=1  api.example.org
example.com                         (duplicate, dropped)

Blank lines, # comments and duplicates are dropped.

Output

	behaviour
no -o	one file per domain, <domain>.txt
-o all.txt	one shared file for every domain

github-endpoints -df scope.txt -o endpoints.txt -q -raw -t $GITHUB_TOKEN

Extended mode

github-endpoints -d solarturbines.com     # -> www.solarturbines.com
github-endpoints -d solarturbines.com -e  # -> www.solarturbines.com + solarturbines.sk

-e searches on the bare name (solarturbines) and keeps any host containing it. Note that on a short/common name it reduces the query to something like "cat", which GitHub throttles immediately — use it on distinctive names.

Tokens

-t accepts a single token, a comma-separated list, or a file with one token per line. Without -t the GITHUB_TOKEN environment variable is read, then a .tokens file in the current directory.

export GITHUB_TOKEN=ghp_token1,ghp_token2
github-endpoints -df scope.txt

Tokens are disabled for ~70 s when GitHub raises a rate-limit alert, then re-enabled. -k exits instead of waiting.

Rate limits. GitHub code search is 10 requests/min per user — the limit is per account, not per token, so multiple PATs from one account do not multiply it. Use -q (quick mode) to skip the language/noise fan-out; a full run on a busy domain issues up to 10 search requests per search and will spend most of its time waiting.

Credits

Original tool by @gwendallecoguic — gwen001/github-endpoints. MIT licensed; this fork keeps the same licence, see LICENSE.md.