Your Full Map To Github Recon And Leaks Exposure
By: Orwa Atyat
Tags: Pentest, Infosec, Bug Bounty, Bugcrowd, Hacking

2- The Best words in dorking And GitHub dorking in my ways Tips Dorks And recon with my way

“site.com” :

here you add your program you wanna search

((you can put “site.com”)) ((“sub.site.com”)) ((“site” only))

but site name like these ((site-site.com))and have these ((-)) the dork without ((“ “ ))

Keyword

my Keyword that i like to use and i will add it with language that i like to use

Jenkins

OTP

oauth

authoriztion

password

pwd

ftp

dotfiles

JDBC

key-keys

send_key-keys

send,key-keys

token

user

login-singin

passkey-passkeys

pass

secret

SecretAccessKey

app_AWS_SECRET_ACCESS_KEY AWS_SECRET_ACCESS_KEY

credentials

config

security_credentials

connectionstring

ssh2_auth_password

DB_PASSWORD



— — — — — — — — — — — — — — — — — — -BASH — — — — — — — — — —

language:bash password

language:bash pwd

language:bash ftp

language:bash dotfiles

language:bash JDBC

language:bash key-keys

language:bash send_key-keys

language:bash send,key-keys

language:bash token

language:bash user

language:bash login-singin

language:bash passkey-passkeys

language:bash pass

language:bash secret

language:bash credentials

language:bash config

language:bash security_credentials

language:bash connectionstring

language:bash ssh2_auth_password

— — — — — — — — — — — — — — — — — — -PYTHON — — — — — — — — —

language:python password

language:python pwd

language:python ftp

language:python dotfiles

language:python JDBC

language:python key-keys

language:python send_key-keys

language:python send,key-keys

language:python token

language:python user

language:python login-singin

language:python passkey-passkeys

language:python pass

language:python secret

language:python credentials

language:python config

language:python security_credentials

language:python connectionstring

language:python ssh2_auth_password

the most lovely for me

password — passwd — pwd — secret — private — Ldap

why ???

because if i use keyword like secret

i can got all of these result

secret_key

secretkey

secret api

secret token

secret pass

secret password

aws secret

client secret

Etc….

these link have good dorks

https://github.com/techgaun/github-dorks/blob/master/github-dorks.txt

Language:

if you have lot lot of codes and work in a Big program

you can dork with language

the best language i like

bash

python

ruby

java

so in dorking with language

just like these

“bugcrowd.com” password language:bash

NOT: **capital**

it’s a very important word

use for filter the result

FOR example

you wanna search for “bugcrowd.com”

and you have like 5K codes

When you browse through these codes

You find a code

like

www.bugcrowd.com

that is constantly being repeated and in a way that annoys you

now you can filter these code by use

“bugcrowd.com” NOT www.bugcrowd ((but in NOT dont add .com))

and you will got like 2K codes

after that you see When you browse through these codes

You find a code

like

test.bugcrowd.com

you can filter these code with the other one by use

“bugcrowd.com” NOT www.bugcrowd NOT test.bugcrowd

and you will got like 1K codes

it’s a very important word use for filter the result FOR example you wanna search for “bugcrowd.com” and you have like 5K codes When you browse through these codes You find a code like www.bugcrowd.com that is constantly being repeated and in a way that annoys you now you can filter these code by use “bugcrowd.com” NOT www.bugcrowd ((but in NOT dont add .com)) and you will got like 2K codes after that you see When you browse through these codes You find a code like test.bugcrowd.com you can filter these code with the other one by use “bugcrowd.com” NOT www.bugcrowd NOT test.bugcrowd and you will got like 1K codes The most big dork ever I use was for Paypal

that dork

“paypal” language:python password NOT sandbox.paypal NOT api.paypal NOT www.paypal NOT gmail.com NOT yahoo.com NOT hotmail.com NOT test

So now Examples

for Org

org:bugcrowd password NOT www.bugcrowd

for User

user:orwagodfather secret

for github page

“bugcrowd.com” language:python secret NOT www.bugcrowd

3- MY TIPS & WAYS & My advice

A:

now

if the program say

in scope:

bugcrowd.com

out of scope

blog.bugcrowd.com

think out of the box

the leaked data all the time in scope

so start search for evrything belong fo bugcrowd

make for your self your scope like these

inscop

*.bugcrowd.*

any domian belong for bugcrowd

B:

when you dorking

Always focus on the most recent date

You need fresh data Not old

I will repeat that: FOCUS ON THE DATE

YOU NEED FRESH DATA NOT OLD DATA

C:

and all the time if you found something for same user

check that user in linkedin if he work for these program or not

some employees hide that where they work in github but dont hide that from linkedin

the dork if you wanna check orwa if he work in bugcrowd that dork in google

orwa atyat bugcrowd linkedin

or

check orwa user search for some ends points or some info about orwa

by dork

user:orwagodfather linkedin

user:orwagodfather full name

user:orwagodfather https://

user:orwagodfather Ldap

and just like these do some recon like if you wanna know about some internal links in org you can do like these

org:bugcrowd https://

org:bugcrowd host:

sometimes you got some lnternal link

This link is for a special or important page

It is not protected by a username and password

Or it requires default credentials

like admin admin

or admin password

with these you have a full access and cool and easy P1 report

With these tips I guarantee you will find something

thats me

i don’t have mythology

i don’t have a leader

i think out the box

I follow Th3g3n3lman because thats man who make my good hunter with shearing all the stuff in twitter

i all the time collaborated with

https://twitter.com/waseyuddin and all thanks for these kind man

4- Some Github Good Tips from my reports

A:

Some companies rely on cloud services specially in that period for remote work, so when you look for credentials on github and similar services remember that examples:

“centrify.com” password

service-now.com password You can try send_keys keyword also.

B:

github+translate

if you search for leaks for Russian program

as example you can put the dork in Russian language

or if you search for user from Italy

you can put the dork in Italian language

that leads to good results

as my found in Russian language

host

user

pass

C:

good #github #Tips

“site.com" password or secret or any keyword

“target.atlassian” password or secret or any keyword

“target.okta” password or secret or any keyword

“corp.target" password or secret or any keyword

“jira.target" password or secret or any keyword

“target.onelogin” password or secret or any keyword

target.service-now password or secret or any keyword

sometime use these tips without any keyword

now i have lot of finds and good bounty

but if you see

i work manually because i like that

but i recommend by any tool

its will be these tool its vary vary good and helpful

https://github.com/obheda12/GitDorker

for these amazing man

https://twitter.com/obheda12

and you can read about in

https://medium.com/@obheda12/gitdorker-a-new-tool-for-manual-github-dorking-and-easy-bug-bounty-wins-92a0a0a6b8d5

Tom Edson did a thousand failed experiments,, But the thousand and one experiment was the lamp ,, So do not be afraid to submit a thousand reports,, every failed experiment is a step closer to success

now this my first write up so sorry and forgive me if i write something you not understand here

Dont forget check th3g3nt3lman Video about github

https://www.youtube.com/watch?v=l0YsEk_59fQ

and my next writup will be about the google dorking

i suggest you add these men

https://twitter.com/waseyuddin

amazing smart and i cant hunt without him

thanks all

orwa atyat

https://twitter.com/GodfatherOrwa