vforvasilis

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

Awesome Github OSINT

nil0x42's tips & tricks

📜 get-github-followers-twitter.py

Scrape twitter account of all github followers of target user on GitHub

📜 get-github-stargazers-twitter.py

Scrape twitter account of all stargazers of target project on GitHub

	console.log("[*] SSL Pinning Bypasses");
	console.log(`[*] Your frida version: ${Frida.version}`);
	console.log(`[*] Your script runtime: ${Script.runtime}`);

	/**
	* by incogbyte
	* Common functions
	* thx apkunpacker, NVISOsecurity, TheDauntless
	* Remember that sslpinning can be custom, and sometimes u need to reversing using ghidra,IDA or something like that.
	* !!! THIS SCRIPT IS NOT A SILVER BULLET !!

	import winim/clr
	import os
	import nimpy

	#Create dup handles
	proc dup(oldfd: FileHandle): FileHandle {.importc, header: "unistd.h".}
	proc dup2(oldfd: FileHandle, newfd: FileHandle): cint {.importc,
	header: "unistd.h".}

	# Gist of the Day: Turbo Intruder Cluster Bomb with SmartFiltering
	# Author: Evan Custodio (@defparam)
	#
	# MIT License
	# Copyright 2021 Evan Custodio
	#
	# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
	#
	# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
	#

	var logger = console.trace;

	// ELEMENT

	;(getElementByIdCopy => {
	Element.prototype.getElementById = function(q) {
	logger('getElementById', q, this, this.innerHTML);
	return Reflect.apply(getElementByIdCopy, this, [q])
	}
	})(Element.prototype.getElementById)

	require 'selenium-webdriver'

	@host = "http://metadata.google.internal/computeMetadata/v1/instance/"

	def setup
	@driver = Selenium::WebDriver.for(
	:remote,
	url: 'https://SELENIUM_URL/wd/hub',
	desired_capabilities: :chrome)
	end

	"""
	This script will search 4chan (need to specify a board unfortunately) and then
	search all comments on Reddit for specific keywords. If found, it will then send
	an email with the links to any matching posts.

	Because 4chan posts are archived after ~48 hours I would recommend setting this up
	to run on that cadence as well.

	Sender email will need "Allow less secure apps" to ON or similar setting.
	I followed these instructions for setting that up: