Personal Access Token (PAT) recon tool for bug bounty hunters, pentesters & red teams
Have you ever found a GitHub or a NPM personal access token (PAT) and wondered "Is this valid?" or "I wonder what a bad guy could do with this?" Well, if so, I've got the tool for you!
Introducing gimmePatz, a comprehensive reconnaissance tool for PATs. gimmePATz will tell you if a PAT is valid, and what kind of PAT it is. It provides information about the user account that created the PAT, including what organizations that user is part of and how many followers they have. gimmePATz will show you what scopes a PAT has and what variables or secrets the PAT has access to. gimmePATz will list what repositories, NPM packages or GitHub Organisations the PAT is attached to as well, and tell you exactly what permissions the PAT has to each resource. This tool is designed for offensive security practitioners, like bug bounty hunters, pentesters and red teams. By using this tool, you agree to use it in a legal context.
You can point gimmePATz at a file and it will find all the PATs in that file and let you know if they are valid. gimmepatz supports JSON output as well, so you can save the output in JSON, and/or pipe the output of gimmePATz into other tools like jq. You can see some examples of the different ways to use gimmePATz in the "Advanced Usage" section below.
gimmepatz.py TOKEN
requests library # pip install requestsgit (for repository downloading)# Discover secrets and variables
gimmepatz.py TOKEN --variables
# Include organization repositories
gimmepatz.py TOKEN --org GITHUB_ORGANIZATION
# JSON output for scripting
gimmepatz.py TOKEN --json
# Combined: organization repos + JSON output
gimmepatz.py TOKEN --org GITHUB_ORGANIZATION --json
# Save the output of gimmePATz in JSON output to a file
gimmepatz.py TOKEN --variables --org target-org --json > assessment.json
# Download all accessible repositories
gimmepatz.py TOKEN --download
# Download only private repositories
gimmepatz.py TOKEN --download --download-type private
# Custom download location
gimmepatz.py TOKEN --download --download-path ./target-repos
# Scan a file to see if it has any PATs in it
gimmepatz.py --scan ./example-file.json
Clone or download the script
git clone https://github.com/6mile/gimmepatz.git
cd ./gimmepatz/ && chmod u+x ./gimmepatz.py
| Option | Description |
|---|---|
--json | Output results in JSON format |
--variables, --var | Enumerate GitHub variables and secrets |
--var-target | Target scope: all, user, repo, org |
--var-name | Specific repository or organization name |
--download | Download all accessible repositories |
--download-path | Custom download directory (default: repos) |
--download-type | Filter: all, private, public |
--org | Include specific GitHub organization analysis |
--debug | Enable verbose debug output |
--scan | Scan local files for PATs |
_ ______ ___ _____
(_) | ___ \/ _ \_ _|
__ _ _ _ __ ___ _ __ ___ ___| |_/ / /_\ \| |____
/ _` | | '_ ` _ \| '_ ` _ \ / _ \ __/| _ || |_ /
| (_| | | | | | | | | | | | | __/ | | | | || |/ /
\__, |_|_| |_| |_|_| |_| |_|\___\_| \_| |_/\_/___|
__/ |
|___/ "Personal Access Token recon tool"
----------------------------------------------------
by @6mile
✅ Token is valid
👤 Authenticated as: octocat
Name: Octocat Maclean
Account type: User
Public repos: 4
Private repos: 3
Followers: 9714
Following: 731
🏢 Organization Memberships (2 total):
👤 Space-Force-Beta (member)
Name: Space-Force-Beta
Description: Building cool stuff for space
Public repos: 2
Private repos: 1
URL: https://github.com/Space-Force-Beta
👑 ThrifyBank (admin)
Description: The thriftiest Neo Bank in Kansas!
Public repos: 1
Private repos: 5
URL: https://github.com/thrifybank-kansas
🔑 Token Scopes (14 total):
• codespace:secrets
• notifications
• read:audit_log
• read:discussion
• read:enterprise
• read:org
• read:packages
• read:project
• read:public_key
• read:repo_hook
• read:user
• repo
• user:email
• workflow
Scope Descriptions:
--------------------------------------------------
repo: Full access to repositories
user: Access to user profile information
notifications: Access to notifications
📊 Rate Limit Status:
Limit: 5000
Remaining: 4999
Reset time: 1234567890
📁 Accessible Repositories:
Found 25 accessible repositories:
• 15 private repositories
• 10 public repositories
🔒 Private Repositories (9):
📂 octocat (3 private repos):
• octocat/internal-api (admin)
• octocat/database (admin)
• octocat/external-api (admin)
📂 Space-Force-Beta (1 private repos):
• Space-Force-Beta/destrukto-beam (admin)
📂 ThriftyBank (5 private repos):
• thriftybank-kansas/web (admin)
• thriftybank-kansas/docker (admin)
• thriftybank-kansas/database-int (admin)
• thriftybank-kansas/bank-vault (admin)
• thriftybank-kansas/SAAS-PORTAL (admin)
🔓 Public Repositories (7):
📂 octocat (4 public repos):
• octocat/sdk (admin)
• octocat/helpdesk-docs (admin)
• octocat/aws-sdk-helpers (admin)
• octocat/stinkyCaptain (admin)
📂 Space-Force-Beta (1 public repos):
• Space-Force-Beta/destrukto-beam (admin)
📂 thrifybank-kansas (1 public repos):
• thrifybank-kansas/node-restify (admin)
{
"token_valid": true,
"user_info": {
"login": "octocat",
"name": "The Octocat",
"type": "User",
"id": 1
},
"scopes": ["repo", "user", "notifications"],
"rate_limit": {
"limit": 5000,
"remaining": 4999,
"reset": 1234567890
},
"repositories": {
"total": 25,
"private": [
{
"name": "mycompany/internal-api",
"owner": "mycompany",
"permissions": {
"admin": true,
"push": true,
"pull": true
},
"url": "https://github.com/mycompany/internal-api"
}
],
"public": [
{
"name": "octocat/awesome-project",
"owner": "octocat",
"permissions": {
"admin": true,
"push": true,
"pull": true
},
"url": "https://github.com/octocat/awesome-project"
}
]
},
"summary": {
"total_repos": 25,
"private_count": 15,
"public_count": 10,
"owners": ["mycompany", "octocat"]
}
}