unbaiat unbaiat

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output

	# twitterfavlinks.py - Throw back all your favorites that contain a url. Get any applicable redirects. Note there are Twitter API
	# limits, so if you have a gazillion favorites, you probably won't get them all. YMMV
	#
	# Author: @curi0usJack
	#
	# Dependencies:
	# Tweepy: sudo pip install tweepy
	# Twitter API access. Set up here: https://apps.twitter.com/

	import tweepy

	import logging
	import urllib

	import webapp2
	import urllib2

	# v1.0.1 - updated to support POST request

	# change to your IP
	redirector = "(insert you C2 domain here)"

	<?php

	/**
	* @param array $data
	* @throws ProductImportException
	*/
	public function createProduct(array $data)
	{
	$originalProduct = $this->productRepository->findOneByCode($data['code']);

	$serviceName = "MyService"

	if (Get-Service $serviceName -ErrorAction SilentlyContinue)
	{
	$serviceToRemove = Get-WmiObject -Class Win32_Service -Filter "name='$serviceName'"
	$serviceToRemove.delete()
	"service removed"
	}
	else
	{

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

	#!/usr/bin/python
	#
	# Shellcode to ASCII encoder leveraging rebuilding on-the-stack technique,
	# and using Jon Erickson's algorithm from Phiral Research Labs `Dissembler`
	# utility (as described in: Hacking - The Art of Exploitation).
	#
	# Basically one gives to the program's output a binary encoded shellcode,
	# and it yields on the output it's ASCII encoded form.
	#
	# This payload will at the beginning align the stack by firstly moving

	<#
	.SYNOPSIS
	This script can bypass User Access Control (UAC) via sdclt.exe for Windows 10.

	Author: @netbiosX
	License: BSD 3-Clause
	Required Dependencies: None
	Optional Dependencies: None

	It creates a registry key in: "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" to perform UAC bypass


	.
	..
	........
	@
	*
	.
	..*
	ðŸŽ