Gitminer 2.0 - Advance Search on Github
•
2 likes•589 views
With the popularization of github, the lack of security control in commits has exposed several sensitive data that can compromise both companies and ordinary users. To make the search easier, I've created a script to automate and collect the results. This script is in version 2.0 with some implementations and improvements in the code, I will demonstrate how to perform the collection and how this can cause a great impact.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Gitminer 2.0 - Advance Search on Github
Similar to Gitminer 2.0 - Advance Search on Github (20)
More from Nullbyte Security Conference
More from Nullbyte Security Conference (15)
Recently uploaded
Recently uploaded (20)
Gitminer 2.0 - Advance Search on Github
- 2. Warning! All content presented does not reflect the views of my employers
- 3. Indice ● Search Syntaxes ● Make Dorks ● How to use Gitminer 2.0 ● Demo ● References ● About Me
- 4. Search Syntaxes • Search by the file contents os file path • Search within a user’s or org’s repos • Search by: - Location - Language - File size - Filename - File extension • Limitations
- 5. Search Syntaxes Example DescriptionSyntax matches code where "root" appears in the file contents.root in:filein:file Search by the file content:
- 6. Search Syntaxes Example DescriptionSyntax matches code where "root" appears in the file path.root in:pathin:path Search by the file path:
- 7. Search Syntaxes Example DescriptionSyntax matches code from @UnkL4b that ends in .py.user:UnkL4b extension:pyuser:UnkL4b Search within a user:
- 8. Search Syntaxes Example DescriptionSyntax matches code from GitHub that ends in .js.org:github extension:jsorg:github Search within a organization:
- 9. Search Syntaxes Example DescriptionSyntax matches code from @mozilla's shumway project that ends in .as. repo:mozilla/shumway extension:asrepo:mozilla/shumway Search within a repository:
- 10. Search Syntaxes Example DescriptionSyntax matches readme files with the word "octocat" that are located at the root level of a repository. octocat filename:readme path:/path:/ Search by file location:
- 11. Search Syntaxes Example DescriptionSyntax matches Perl files with the word "form" in a cgi-bin directory, or in any of its subdirectories. form path:cgi-bin language:perlpath:cgi-bin Search by file directory:
- 12. Search Syntaxes Example DescriptionSyntax matches Perl files with the word "form" in a cgi-bin directory, or in any of its subdirectories. form path:cgi-bin language:perllanguage:perl Search by language:
- 13. Search Syntaxes Example DescriptionSyntax matches code with the word "function," written in Python, in files that are larger than 10 KB. function size:>10000 language:pythonsize:>10000 Search by size:
- 14. Search Syntaxes Example DescriptionSyntax matches .vimrc files with the word "commands."filename:.vimrc commandsfilename:.vimrc Search by filename:
- 15. Search Syntaxes Example DescriptionSyntax matches code from GitHub that ends in .js.org:github extension:jsextension:js Search within a extension:
- 16. Search Syntaxes Limitations: Only files smaller than 384 KB are searchable. Except with filename searches, you must always include at least one search term when searching source code. For example, searching for language:javascript is not valid, while amazing language:javascript is. You can't construct a query using more than five AND, OR, or NOT operators At most, search results can show two fragments from the same file, but there may be more results within the file.
- 17. Make Dorks "Bearer SG." in:file AND sendgrid in:file Starting the API key Search text in file content Search text in file content Text to search Sendgrid API Search: Logic operator
- 19. Make Dorks root extension:json filename:mup Word anywhere in the file Search by extension Search by filename SSH Credentials - Meteor config:
- 20. Result SSH Credentials - Meteor config: Total: 1,293
- 21. Make Dorks ".gov.br" in:file AND "password" in:file Word anywhere in the file Logic operator Brazilian Government password exposure:
- 22. Result Brazilian Government password exposure: Total: 20,532
- 23. Talk is cheap, show me the code!
- 24. References ● https://help.github.com/articles/searching-code/ ● http://blog.conviso.com.br/github-hacking-for-fun-and-sensitive-data-search/ ● https://github.com/convisoappsec/research_github_hack ● http://seclists.org/fulldisclosure/2013/Jun/15 ● http://www.hackinsight.org/news,573.html
- 25. About Me Danilo - @UnkL4b github.com/UnkL4b unkl4b.github.io