hyperized

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output

Use PHP-CS-Fixer in PHPStorm

Install PHP-CS-Fixer on your local machine according to these instructions: https://github.com/FriendsOfPHP/PHP-CS-Fixer
Open PHPStorm, Preferences > Tools > External Tools and enter these values:
Program, edit to match your path where PHP-CS-Fixer lives: /.composer/vendor/friendsofphp/php-cs-fixer/php-cs-fixer
Parameters: --rules=@PSR2 --verbose fix $FileDir$/$FileName$. Note that previous verions of PHP-CS-Fixer used --levels instead of --rules.
Working directory: $ProjectFileDir$

Click OK and Apply. Now we'll set up a shortcut.

Go to Preferences > Keymap and search for "PHP Fixer" (or whatever name you gave it). Add whatever shortcut you like, I'm using ctrl + cmd + ]:

This is slightly trickier than I anticipated so noting it down for future reference.

The command should be along these lines (assuming AWS keys are configured via environment variables or config file):

$ docker-machine create \
  -d amazonec2 \
  --amazonec2-region us-west-1 \
  --amazonec2-ami ami-818bd5e1 \
 --amazonec2-zone b \

FWIW: I (@rondy) am not the creator of the content shared here, which is an excerpt from Edmond Lau's book. I simply copied and pasted it from another location and saved it as a personal note, before it gained popularity on news.ycombinator.com. Unfortunately, I cannot recall the exact origin of the original source, nor was I able to find the author's name, so I am can't provide the appropriate credits.

Effective Engineer - Notes

By Edmond Lau
Highly Recommended 👍
http://www.theeffectiveengineer.com/

What's an Effective Engineer?

In your local clone of your forked repository, you can add the original GitHub repository as a "remote". ("Remotes" are like nicknames for the URLs of repositories - origin is one, for example.) Then you can fetch all the branches from that upstream repository, and rebase your work to continue working on the upstream version. In terms of commands that might look like:

Add the remote, call it "upstream":

git remote add upstream https://github.com/whoever/whatever.git

Fetch all the branches of that remote into remote-tracking branches, such as upstream/master:

git fetch upstream

Basic RESTful API with Symfony 3 + FOSRestBundle (JSON format only) + FOSUserBundle + FOSOauthServerBundle

The API we are creating in this gist will follow these rules :

The API only returns JSON responses
All API routes require authenticationu
Authentication is handled via OAuth2 with password Grant Type only (no need for Authorization pages and such).
API versioning is managed via a subdomain (e.g. v1.api.example.com)

The API will be written in PHP with the Symfony 3 framework. The following SF2 bundles are used :

	Mute these words in your settings here: https://twitter.com/settings/muted_keywords

	ActivityTweet
	generic_activity_highlights
	generic_activity_momentsbreaking
	RankedOrganicTweet
	suggest_activity
	suggest_activity_feed
	suggest_activity_highlights
	suggest_activity_tweet

	<?php
	// Context: I'm trying to argue that DI (and DIC) are great, and DIC libs suck.
	// Happy to be proven wrong!

	final class Router {
	private $dependencies;
	public function __construct (Dependencies $dependencies) {
	$this->dependencies = $dependencies;
	// You might say that this is Service Locator, but it's not. This router is toplevel,
	// and toplevel must have access to dependencies. After that it can all just bubble nicely using proper DI.

	<?php
	public function foos() {

	$relation = $this->hasMany('App\Bar');

	return $relation; // default behaviour

	// modify the query builder
	$relation->where('foo','bar');
	return $relation;