{"id":948,"date":"2024-03-23T01:01:02","date_gmt":"2024-03-23T01:01:02","guid":{"rendered":"https:\/\/hacking.cool\/?p=948"},"modified":"2024-03-23T01:27:46","modified_gmt":"2024-03-23T01:27:46","slug":"hidden-treasures-of-websites-on-github","status":"publish","type":"post","link":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/","title":{"rendered":"Hidden Treasures of Websites on GitHub"},"content":{"rendered":"
\n
\"\"<\/figure><\/div>\n\n\n

In the vast expanse of the internet, websites are mere islands in an ocean of code. And for the curious hacker, GitHub’s endless repositories hold the treasure maps to these islands. But what if these maps also contained hidden secrets? Keys to hidden doors, forgotten passages, and unguarded treasures? Today, we’re diving into the depths of GitHub to unearth these secrets, revealing how even the most secure websites might have vulnerabilities etched into their very blueprint, accessible for those who know where to look.<\/p>\n\n\n\n

The Treasure Hunt Begins: Understanding GitHub<\/h4>\n\n\n\n

GitHub, the world’s largest host of source code, is a hacker’s haven for reconnaissance. It’s where developers store the heart of websites\u2014source code, configuration files, and scripts. But sometimes, they inadvertently check in sensitive data: API keys, passwords, and secret tokens that are meant to be kept out of public view.<\/p>\n\n\n\n

Tools of the Trade: GitHub Dorking<\/h4>\n\n\n\n

The hunt for secrets begins with GitHub Dorking<\/em>\u2014using search queries to find sensitive information exposed in GitHub repositories. Similar to Google Dorking, it leverages GitHub’s search engine to sift through public code with precision.<\/p>\n\n\n\n

Here’s how to start:<\/p>\n\n\n\n

Search for High-Value Targets<\/strong>: Keywords like password<\/code>, secret<\/code>, key<\/code>, token<\/code>, can yield interesting results. Combine them with specific file names like config.yml<\/code>, .env<\/code>, or database.ini<\/code> for more focused hunting.<\/p>\n\n\n\n

Let’s say, for instance, we want to find AWS credentials, which are often unintentionally committed to public repositories. AWS credentials are used to authenticate and authorize calls to AWS services. They typically consist of an Access Key ID and Secret Access Key. Because of their power and the level of access they can grant, finding exposed AWS credentials can lead to significant security vulnerabilities.<\/p>\n\n\n\n

Here’s how you might structure your search queries to find AWS credentials:<\/p>\n\n\n\n

Query: AWS_ACCESS_KEY_ID=AKIA[0-9A-Z]{16}\nSearches for AWS Access Key IDs, which start with \"AKIA\" followed by 16 alphanumeric characters.\n\nQuery: aws_secret_access_key\nLooks for instances of the string \"aws_secret_access_key\", commonly found in AWS SDK configurations.\n\nQuery: filename:.properties aws_access_key_id\nTargets .properties files containing \"aws_access_key_id\", often used in Java applications.\n<\/code><\/pre>\n\n\n\n
Explore Commit History<\/strong>: Sometimes, secrets are removed from the current version of the code but remain in the commit history. Exploring previous commits might reveal secrets not visible in the latest codebase.<\/p>\n\n\n\n
Look for Hidden Directories and Files<\/strong>: Directories named .git<\/code> or files like .htaccess<\/code> can sometimes be overlooked by developers when cleaning up sensitive data.<\/p>\n\n\n
\n
\"\"<\/figure><\/div>\n\n\n
Automating the Hunt: Tools to Enhance Your Search<\/h4>\n\n\n\n
Several tools can automate GitHub Dorking, making the search for secrets more efficient:<\/p>\n\n\n\n
GitRob<\/strong>: A tool designed to find sensitive files pushed to public repositories on GitHub. GitRob will scan and flag potential sensitive files based on their names.<\/p>\n\n\n\n
    \n
  1. gitrob analyze <organization><\/code> – Analyzes all repositories belonging to a GitHub organization for sensitive files.<\/li>\n\n\n\n
  2. gitrob analyze <user><\/code> – Analyzes all repositories owned by a specific GitHub user for sensitive files.<\/li>\n\n\n\n
  3. gitrob serve<\/code> – Starts the GitRob web interface to review findings from the analysis.<\/li>\n\n\n\n
  4. gitrob -h<\/code> – Displays help information, listing all commands and options.<\/li>\n\n\n\n
  5. gitrob version<\/code> – Displays the current version of GitRob.<\/li>\n<\/ol>\n\n\n\n
    TruffleHog<\/strong>: Digs deep into commit histories to find strings with high entropy, often indicative of sensitive keys.<\/p>\n\n\n\n
      \n
    1. trufflehog --regex --entropy=False git@github.com:user\/repo.git<\/code> – Scans a repository’s git history for secrets, skipping entropy checks.<\/li>\n\n\n\n
    2. trufflehog file:\/\/path\/to\/repo --since_commit=commit_hash<\/code> – Scans a local repository from a specific commit hash.<\/li>\n\n\n\n
    3. trufflehog git@github.com:user\/repo.git --json<\/code> – Outputs findings in JSON format.<\/li>\n\n\n\n
    4. trufflehog --exclude_paths=regexes.json git@github.com:user\/repo.git<\/code> – Excludes paths matching the regexes in regexes.json<\/code>.<\/li>\n\n\n\n
    5. trufflehog --rules=custom_rules.json git@github.com:user\/repo.git<\/code> – Uses custom rules defined in custom_rules.json<\/code> for scanning.<\/li>\n<\/ol>\n\n\n\n
      Gitleaks<\/strong>: Provides a way to find unencrypted secrets shipped to the repository and supports a vast array of sources to cover your scanning needs comprehensively.<\/p>\n\n\n\n
        \n
      1. gitleaks detect --source='https:\/\/github.com\/user\/repo.git'<\/code> – Detects secrets in the specified remote repository.<\/li>\n\n\n\n
      2. gitleaks protect --staged<\/code> – Scans staged changes in your local git repository for secrets.<\/li>\n\n\n\n
      3. gitleaks --path=\/path\/to\/repo --verbose<\/code> – Scans a local repository for secrets, with verbose output.<\/li>\n\n\n\n
      4. gitleaks --config=config.toml --source='https:\/\/github.com\/user\/repo.git'<\/code> – Uses a custom configuration file for scanning the specified repository.<\/li>\n\n\n\n
      5. gitleaks --source='https:\/\/github.com\/user\/repo.git' --report=report.json<\/code> – Outputs findings to a report.json<\/code> file.<\/li>\n<\/ol>\n\n\n\n
        <\/p>\n","protected":false},"excerpt":{"rendered":"
        In the vast expanse of the internet, websites are mere islands in an ocean of code. And for the curious hacker, GitHub’s endless repositories hold the treasure maps to these islands. But what if these maps also contained hidden secrets? Keys to hidden doors, forgotten passages, and unguarded treasures? Today, we’re diving into the depths…<\/span><\/p>\n
        Read More<\/a><\/p>\n","protected":false},"author":3,"featured_media":956,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-948","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"yoast_head":"\nHidden Treasures of Websites on GitHub - hacking.cool<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hidden Treasures of Websites on GitHub - hacking.cool\" \/>\n<meta property=\"og:description\" content=\"In the vast expanse of the internet, websites are mere islands in an ocean of code. And for the curious hacker, GitHub’s endless repositories hold the treasure maps to these islands. But what if these maps also contained hidden secrets? Keys to hidden doors, forgotten passages, and unguarded treasures? Today, we’re diving into the depths…Read More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/\" \/>\n<meta property=\"og:site_name\" content=\"hacking.cool\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-23T01:01:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-23T01:27:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/0dd6a8b7-fd4e-4bae-8d33-b6800e855476.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1792\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Atom\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Atom\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#website\",\"url\":\"https:\/\/hacking.cool\/atomanya\/\",\"name\":\"hacking.cool\",\"description\":\"is the hacking school \ud83d\udc69\ud83c\udffb\u200d\ud83d\udcbb\ud83e\uddd1\ud83c\udffb\u200d\ud83d\udcbb\ud83d\uddfa\ud83d\udcda\ud83d\udcd6\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hacking.cool\/atomanya\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#primaryimage\",\"url\":\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/0dd6a8b7-fd4e-4bae-8d33-b6800e855476.webp\",\"contentUrl\":\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/0dd6a8b7-fd4e-4bae-8d33-b6800e855476.webp\",\"width\":1792,\"height\":1024},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/\",\"url\":\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/\",\"name\":\"Hidden Treasures of Websites on GitHub - hacking.cool\",\"isPartOf\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#primaryimage\"},\"datePublished\":\"2024-03-23T01:01:02+00:00\",\"dateModified\":\"2024-03-23T01:27:46+00:00\",\"author\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2\"},\"breadcrumb\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hacking.cool\/atomanya\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hidden Treasures of Websites on GitHub\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2\",\"name\":\"Atom\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g\",\"caption\":\"Atom\"},\"url\":\"https:\/\/hacking.cool\/atomanya\/author\/atom\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hidden Treasures of Websites on GitHub - hacking.cool","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/","og_locale":"en_US","og_type":"article","og_title":"Hidden Treasures of Websites on GitHub - hacking.cool","og_description":"In the vast expanse of the internet, websites are mere islands in an ocean of code. And for the curious hacker, GitHub’s endless repositories hold the treasure maps to these islands. But what if these maps also contained hidden secrets? Keys to hidden doors, forgotten passages, and unguarded treasures? Today, we’re diving into the depths…Read More","og_url":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/","og_site_name":"hacking.cool","article_published_time":"2024-03-23T01:01:02+00:00","article_modified_time":"2024-03-23T01:27:46+00:00","og_image":[{"width":1792,"height":1024,"url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/0dd6a8b7-fd4e-4bae-8d33-b6800e855476.webp","type":"image\/webp"}],"author":"Atom","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Atom","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/hacking.cool\/atomanya\/#website","url":"https:\/\/hacking.cool\/atomanya\/","name":"hacking.cool","description":"is the hacking school \ud83d\udc69\ud83c\udffb\u200d\ud83d\udcbb\ud83e\uddd1\ud83c\udffb\u200d\ud83d\udcbb\ud83d\uddfa\ud83d\udcda\ud83d\udcd6","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hacking.cool\/atomanya\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#primaryimage","url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/0dd6a8b7-fd4e-4bae-8d33-b6800e855476.webp","contentUrl":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/0dd6a8b7-fd4e-4bae-8d33-b6800e855476.webp","width":1792,"height":1024},{"@type":"WebPage","@id":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/","url":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/","name":"Hidden Treasures of Websites on GitHub - hacking.cool","isPartOf":{"@id":"https:\/\/hacking.cool\/atomanya\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#primaryimage"},"datePublished":"2024-03-23T01:01:02+00:00","dateModified":"2024-03-23T01:27:46+00:00","author":{"@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2"},"breadcrumb":{"@id":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hacking.cool\/atomanya\/hidden-treasures-of-websites-on-github\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hacking.cool\/atomanya\/"},{"@type":"ListItem","position":2,"name":"Hidden Treasures of Websites on GitHub"}]},{"@type":"Person","@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/804a839cfa61d89d69fb2cf1d2f0adc2","name":"Atom","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ac4d05ec7d617e7f2dee5855900a855a?s=96&d=mm&r=g","caption":"Atom"},"url":"https:\/\/hacking.cool\/atomanya\/author\/atom\/"}]}},"jetpack_featured_media_url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2024\/03\/0dd6a8b7-fd4e-4bae-8d33-b6800e855476.webp","_links":{"self":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/948","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/comments?post=948"}],"version-history":[{"count":14,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/948\/revisions"}],"predecessor-version":[{"id":970,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/948\/revisions\/970"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/media\/956"}],"wp:attachment":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/media?parent=948"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/categories?post=948"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/tags?post=948"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}