Marco Carlo Feliciano Shotokhan

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output

	#include <stdio.h>
	#include <cpuid.h>
	#include <stdint.h>

	int cpu_supports_cet_shadow_stack() {
	uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
	__cpuid_count(7, 0, eax, ebx, ecx, edx);
	return (ecx & (1 << 7)) != 0;
	}

	Thanks to https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html#pulsar_step5 for the description

	kd> dps srv!SrvTransaction2DispatchTable
	91463530 9148b56f srv!SrvSmbOpen2
	91463534 91485fe4 srv!SrvSmbFindFirst2
	91463538 9148606d srv!SrvSmbFindNext2
	9146353c 91488a89 srv!SrvSmbQueryFsInformation
	91463540 914892f3 srv!SrvSmbSetFsInformation
	91463544 9147ff65 srv!SrvSmbQueryPathInformation
	91463548 91480c74 srv!SrvSmbSetPathInformation

	# Basics of Elliptic Curve Cryptography implementation on Python
	import collections


	def inv(n, q):
	"""div on PN modulo a/b mod q as a * inv(b, q) mod q
	>>> assert n * inv(n, q) % q == 1
	"""
	for i in range(q):
	if (n * i) % q == 1: