Thread by @HackerGautam

Github Recon 101 🏆👇

1. Manual Enumeration
2. Automated Enumeration

@shifacyclewala @Hacktifycs
#bugbountytips #bugbounty #infosec #cybersecurity #hacking

💡Manual:
GitHub Dorking is basically finding leaks in the code pushed by the target organisation or its employees.

1. org: evilcorp[.]com
2. language:"bash" org:evilcorp[.]com
3. "target[.]com" language:python "secret" "password" "key" NOT docs NOT sandbox NOT test NOT fake

💡Dorks:

Jenkins
Jira
OTP
oauth
authoriztion
password
pwd
ftp
ssh
dotfiles
JDBC
token
user
pass
secret
SecretAccessKey
AWS_SECRET_ACCESS_KEY
credentials
config
security_credentials
S3
https://

💡Employees:
Find the matching People working for the organisation and leaking sensitive details.

1. huntr[.]io
2. site:linkedin[.]com intext:software engineer at TargetORG
3. github[.]com/orgs/google/people

💡Finding Files :
filename:manifest.xml
filename:travis.yml
filename:vim_settings.xml
filename:database
filename:prod.exs NOT prod.secret.exs
filename:prod.secret.exs
filename:.npmrc _auth
filename:.dockercfg auth
filename:WebServers.xml
filename:.bash_history <Domain name>

💡Finding Usernames:
user:name (user:admin)
org:name (org:google type:users)
in:login (<username> in:login)
in:name (<username> in:name)
fullname:firstname lastname (fullname:<name> <surname>)
in:email (data in:email)

💡Finding using Extension:
extension:pem private
extension:ppk private
extension:sql mysql dump
extension:sql mysql dump password
extension:yaml secret.yaml

💡Automated Techniques (Tools):
Trufflehog
gittyleaks
Github-Dorks
Watchtower
grep[.]app
gitrob
githound
gitmonitor
gitsecrets