Alex Bender alex-bender

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output

Introduction

When applications are running in production, they become black boxes that need to be traced and monitored. One of the simplest, yet main, ways to do so is logging. Logging allows us - at the time we develop our software - to instruct the program to emit information while the system is running that will be useful for us and our sysadmins.

How to Build a Successful Information Security Career (Daniel Miessler)
- https://danielmiessler.com/blog/build-successful-infosec-career/#gs.DtVCbbw
The First Steps to a Career in Information Security (Errata Security - Marisa Fagan)
- http://blog.erratasec.com/2010/04/first-steps-to-career-in-information.html#.WFrbofkrIuU
Hiring your first Security Professional (Peerlyst - Dawid Balut)
- https://www.peerlyst.com/posts/hiring-your-first-security-professional-dawid-balut
How to Start a Career in Cyber security
- https://www.concise-courses.com/security/how-to-start-your-career/
How to Get Into Information Security (ISC^2)
https://www.isc2.org/how-to-get-into-information-security.aspx

#Introduction to Devops Resources:

##Chapter 1

2015 State of DevOps Report https://puppet.com/resources/white-paper/2015-state-of-devops-report

Knight Capital https://en.wikipedia.org/wiki/Knight_Capital_Group

FWIW: I (@rondy) am not the creator of the content shared here, which is an excerpt from Edmond Lau's book. I simply copied and pasted it from another location and saved it as a personal note, before it gained popularity on news.ycombinator.com. Unfortunately, I cannot recall the exact origin of the original source, nor was I able to find the author's name, so I am can't provide the appropriate credits.

Effective Engineer - Notes

By Edmond Lau
Highly Recommended 👍
http://www.theeffectiveengineer.com/

	;; Boot to PRINT10
	;;
	;; Use nasm to assemble the code to a binary:
	;;
	;; $ nasm -f bin -o boot.bin boot.nasm
	;;
	;; Use dd to make an empty floppy disk image:
	;;
	;; $ dd if=/dev/zero of=boot.flp ibs=1k count=1440
	;;

	version: "3"

	services:
	concourse-db:
	image: postgres:9.5
	environment:
	- POSTGRES_DB=concourse
	- POSTGRES_USER=concourse
	- POSTGRES_PASSWORD=changeme
	- PGDATA=/database

	"""
	Minimal character-level Vanilla RNN model. Written by Andrej Karpathy (@karpathy)
	BSD License
	"""
	import numpy as np

	# data I/O
	data = open('input.txt', 'r').read() # should be simple plain text file
	chars = list(set(data))
	data_size, vocab_size = len(data), len(chars)

	# Mostly taken from: http://nbviewer.ipython.org/github/bmcfee/librosa/blob/master/examples/LibROSA%20demo.ipynb

	import librosa
	import matplotlib.pyplot as plt

	# Load sound file
	y, sr = librosa.load("filename.mp3")

	# Let's make and display a mel-scaled power (energy-squared) spectrogram
	S = librosa.feature.melspectrogram(y, sr=sr, n_mels=128)

	cd fonts
	mv *.ttf /usr/share/fonts/truetype
	cd /usr/share/fonts/truetype
	mkfontscale
	mkfontdir
	fc-cache
	xset fp rehash

Alex Bender alex-bender

GitHub for Bug Bounty Hunters

Mass Cloning

Introduction

Effective Engineer - Notes

What's an Effective Engineer?